Koz_18 0 Posted August 23, 2018 Share Posted August 23, 2018 My laptop (Lenovo Thinkpad Edge - with Windows 7 Home Premium [64-bit]) has been receiving multiple "Address has been blocked" notifications from ESET Internet Security. I'm not sure for how long its been going on. Pictures of notifications attached. Address (I purposefully put spaces between slashes): https: // s3.amazonaws.com / casge-js / 1d4bbf3f0bf70fccdd.js The IP Address (found in the "Details") changes from 52.216.100.77 and 52.216.0.163, which google says are both associated to Amazon Technologies Inc. What I've noticed is that it doesn't matter what site you're on, the notifications pop up in bunches (maximum I've seen is 46) I'm not sure what do to next to find/remove this address and stop the notifications. Link to comment Share on other sites More sharing options...
Administrators Marcos 4,910 Posted August 23, 2018 Administrators Share Posted August 23, 2018 You didn't mention what browser you use. It appears to be a JS/Revizer that accesses the url. Try launching the browser without extensions / add-ons loaded. Also collect logs with ELC and provide me with the generated archive. Link to comment Share on other sites More sharing options...
Koz_18 0 Posted August 23, 2018 Author Share Posted August 23, 2018 6 hours ago, Marcos said: You didn't mention what browser you use. It appears to be a JS/Revizer that accesses the url. Try launching the browser without extensions / add-ons loaded. Also collect logs with ESET Log Collector and provide me with the generated archive. I use Google Chrome. I've disabled all the extensions I use and haven't seen the "Address has been blocked" notification for the past hour or so - that looks promising . I've attached the log collection zip folder, I wasn't sure if I was supposed to send certain files so I just attached the whole zip folder. Link to comment Share on other sites More sharing options...
Administrators Marcos 4,910 Posted August 23, 2018 Administrators Share Posted August 23, 2018 The logs looked ok. Let's try enabling one extension at a time to find the one which is triggering the url block. We'd like to know what extension it is and get it for blacklisting. Link to comment Share on other sites More sharing options...
Koz_18 0 Posted August 24, 2018 Author Share Posted August 24, 2018 6 hours ago, Marcos said: The logs looked ok. Let's try enabling one extension at a time to find the one which is triggering the url block. We'd like to know what extension it is and get it for blacklisting. I believe the extension causing the url block is "Cloud Convert" : https://chrome.google.com/webstore/detail/cloudconvert-convert-anyt/kdmjifkppcjphfoplcicglcfcpbdoibo?utm_source=chrome-ntp-icon Only when enabled in chrome does this "Address has been blocked" notification pop up. The website itself (https://cloudconvert.com/) doesn't cause any issues, just having the chrome extension causes issues. Link to comment Share on other sites More sharing options...
Recommended Posts