Need Advice on popup

[LinkinForcer 1]

Hey guys,

So about an hour ago I went to a webpage on pcgamer and shortly after it loaded I received a popup from ESET Smart Securty 9. I am running Windows 10 and using Firefox.

It was telling me that a yahoo website tried to connect and wanted to know if I wanted to block or allow it. It said it was blocking it because of an invalid certificate and it could be a potential threat to gather information.

I clicked view details and it said that it was reported 5 days ago and had a green check next to the reputation.

I went ahead and clicked block just to make sure I would be safe.

I then decided to go into my ESET and look for the blocked website to see if I could read up on what I had just blocked. Only problem is I can't find where any website has been blocked at all. I also did a image search for ESET warnings so that I could attach an example of the warning that I received but I couldn't find one that matched what I saw.

My questions are (1) Does anyone know what I am talking about? (2) Was this connection to the site just terminated when I clicked blocked, therefore not giving ESET something to log? and (3) Was this action supposed to have been logged and if so where can I find it?

I've already been through my logs, and went through several tabs to check blocked websites which are all blank.

Just a bit confused on why this doesn't seem to have been logged. If it is something that isn't logged then ok no big deal but I would of liked to of seen at least a log file on me blocking the page so that I could go back and check the details again.

Edited August 29, 2016 by LinkinForcer

[caleb59 2]

Same issue with weird yahoo website invalid certificate I've had here: hxxp://www.zdnet.com/article/windows-10-tip-turn-off-cortana-completely/ and I just block it once...

Edited August 29, 2016 by caleb59

[Marcos 5,070]

@LinkinForcer: Please provide a screen shot of the warning as well as a link to the website on which it pops up.

The problem with Zdnet is not caused by ESET. The problem is they are using a certificate not issued for that domain:

 

[LinkinForcer 1]

I wish I could provided a screen shot of the pop up but now it doesn't happen.

I was wrong about the website it wasn't pcgamer it was gamespot.com. Here is the exact link that I went to

hxxp://www.gamespot.com/forums/pc-mac-linux-society-1000004/starcraft-2-overheating-gpu-bug-and-a-fix-for-it-27403538/

When I go there now it doesn't happen. That's why I was wondering if maybe it was a random even, such as a specific ad that was on screen that triggered the warning or if it isn't showing up now because ESET is continuously blocking it now. Only thing is there isn't a log of it being blocked anywhere within ESET that I can find. That is what led me to the assumption that it just terminated the connection to it for that web session and now whatever triggered it to begin with isn't showing up anymore.

Plus my initial questions were never answered.

I'd figure everything is fine because I blocked it and also like I said the reputation had a green check by it with little people figures by it stating that it was reported 5 days ago.

Almost as if this specific area of yahoo has an invalid certificate because it may be expired yet the web page is still safe.

I would just like further confirmation of this and also would like to know that my ESET product is working properly since I can't find a log of the website being blocked.

[LinkinForcer 1]

Also I never said that this was a problem with ESET. It sounds like Caleb had the same thing happen to him that happened to me just on a different site.

As for the certificate issue, that was the reason ESET warned me about this yahoo page to beginning with, because of a invalid certificate.

[LinkinForcer 1]

Also one question for Caleb.

Now when you return to that site after blocking that yahoo page do still get a warning anymore?

Edited August 29, 2016 by LinkinForcer

[caleb59 2]

It's TOTALLY random - sometimes it showing up, sometimes not: hxxp://i.imgur.com/LK2eYBJ.jpg

[LinkinForcer 1]

Yes that would be the warning I got. There is a screen shot Marco only difference is it popped up for me on the website link I posted.

I'm pretty sure this is a false positive because of the reputation having a green check mark by it in the details section of the warning.

Also with what Caleb has stated since the warning is random for him that tells me the ESET terminates the connection to the site when you hit block just for that web session which explains why it isn't logged anywhere within ESET.

I would like to know why this kind of activity isn't logged by ESET for later viewing though. Anything like this should be logged even if it is just a temporary block.

[LinkinForcer 1]

Also with this being a random event for Caleb and since it has only happened once for myself it also appears that this is triggered by a possible ad on the website. I know gamespot places ads that link to other websites along the right side of the page and at the bottom.

Caleb I'm on my phone so I can't really tell. Does that website also have ads that would like to other websites?

[caleb59 2]

Maybe some hidden ads? I'm using Adguard to block ads on websites but who knows - maybe something hidden is triggering this popup...

[LinkinForcer 1]

That's what I'm thinking because I use Adblock and still receive a few ads from time to time. Thanks for your feed back I'm glad I'm not the only one to experience this.

I'm may call ESET and talk to them about having these events logged.

Does this warning show up in any of your logs?

[LinkinForcer 1]

Hey so just an update I was able to get the warning to popup again. Since I have Firefox I can see the process the webpages take to load everything on the bottom left.

That website did appear again but it only triggered the warning once out of 4 times of me loading the page.

I also tried to see if the warning would popup on zdnet.com and I could not get it to popup.

I didn't even see that website in the process while loading that page.

I'm just going to take this as being a false positive since it is very random and doesn't always trigger the warning.

I will still block it if it is to reappear again.

[caleb59 2]

In my opinion you can relax a bit - you blocked it every time so no harm was made to your system and I think this isn't harmfull certificate so blocking it and avoiding that website if you can will minimize eventual risk of your system infection...

[LinkinForcer 1]

I'm not worried about it. Just figured I'd update you guys. The reputation in the details has a green check by it so it looks like people are reporting to ESET as it being non-harmful.