MBAM Says Chrome is Harmful?

[ashley92]

I noticed today that MalwareBytes keeps popping up in the corner saying that it has detected something potentially harmful (I have Pro version), but it lists chrome.exe as the culprit even after I closed out of Google Chrome. I then ran a quick scan but nothing showed (everything is up to date).

Any ideas?

[SpySentinel]

Hi ashley92,

Welcome to the Malwarebytes Support Forums

Malwarebytes' Anti-Malware isn't actually blocking Google Chrome, but the malicious site that was being accessed through Google Chrome. Malwarebytes' Anti-Malware is showing the source that is trying to intercept the malicious IP, and is blocking the IP, not the source which is Google Chrome in this case.

I recommend you visit our Malware Removal Forum if you believe you have an infection so we can help clean it up:

http://forums.malwarebytes.org/index.php?showforum=7

[ashley92]

Hi ashley92,

Welcome to the Malwarebytes Support Forums

Malwarebytes' Anti-Malware isn't actually blocking Google Chrome, but the malicious site that was being accessed through Google Chrome. Malwarebytes' Anti-Malware is showing the source that is trying to intercept the malicious IP, and is blocking the IP, not the source which is Google Chrome in this case.

I recommend you visit our Malware Removal Forum if you believe you have an infection so we can help clean it up:

http://forums.malwarebytes.org/index.php?showforum=7

Thanks, SpySentinel. I had wondered that but wasn't sure since the warning persisted after the Chrome itself was no longer running nor was showing running processes. I will run a Full Scan and see if it catches anything.

[SpySentinel]

You're welcome.

Please post the scan results here when finished.

Also, can you please attach the protection log?

To view your logs Open Malwarebytes Anti-Malware and go to the Logs tab. Click on the protection-log that matches the current date, then click on Open. Post those results here as well.

Thanks!

[ashley92]

The quick scan returned no infected files. Am currently doing a full scan (it will of course take a while).

Protection Log from today is attached.

protection-log-2011-05-10.txt

[SpySentinel]

Are you visiting any sites when you get the IP Blocking popups?

Malwarebytes will block the malicious IPs from ads hosted on websites you visit, even while watching movies or playing games online. The website will still load, but you will be notified that Malwarebytes has blocked the malicious IP.

[ashley92]

I didn't start going to any different websites than usual, and this is the first time this has happened. I was actually on the site I moderate for when it started, and I go there multiple times a day. Usually I get the notification when I visit a player's page and they have it covered with icons, but I can click the X in the notification and move on and it stops. This is the first time it has ever popped up and stayed there no matter how many times I exited out of the notification or went to a different page on the site. It also persisted after the website and browser were both closed.

[ashley92]

Since my full scan has now finished,here are the results:

5/11/2011 1:22:23 AM

mbam-log-2011-05-11 (01-22-23).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 645641

Time elapsed: 3 hour(s), 7 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Nothing has been found.

[noknojon]

Hi ashley,

Can you post the top of the log that looks like this below please. It should be there.

I just grabbed an old one of mine for an example.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6497

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

08/05/11 2:29:57 PM

mbam-log-2011-05-08 (14-29-57).txt

Scan type: Full scan (C:\|)

Objects scanned: 249072

Time elapsed: 1 hour(s), 5 minute(s), 3 second(s)

Thank You

[ashley92]

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6551

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

5/11/2011 1:22:23 AM

mbam-log-2011-05-11 (01-22-23).txt

[AdvancedSetup]

Hello ashley92 and Welcome to Malwarebytes

From your description you appear to be infected, here are the steps needed to get your computer cleaned....

If nothing else they will be able to assist you further in determining what is going on.

Please read the following so that you can begin the cleaning process:

You have 3 Options that you can choose from as listed below:

• Option 1

[John A]

Chrome process(es) can be running in the background even when Chrome is closed. Put "google chrome running in background" into your search engine and have a look at some of the discussions.

[AdvancedSetup]

But you should not be getting IP block alerts - if you are then something is going on that probably shouldn't be going on, thus the recommendation to have someone assist in investigating further.