Eset threat window keeps appearing but scan is clean

[Chouett 0]

Hello,

 

I am having some issues with a threat dialog box which appears often, however the Eset scan does not seem to detect anything that it can quarantine and clean.

 

Could you please help me solve the issue?

 

Thank you.

 

VB

[glugy 11]

this is a big bug...

[itman 1,538]

Please post a screen shot of the alert you are receiving.

[TomFace 539]

Please post a screen shot of the alert you are receiving.

Yes please show us....

[Marcos 4,705]

I second that, post a screen shot as we have no clue what you mean.

[Chouett 0]

Hi, 

 

sorry it took me a while to get back on line,

As soon as it appears I will post a screen shot.

[Chouett 0]

     How do I upload the screenshot? as copy paste does not seem to work?

[TomFace 539]

Once you do the print screen/paint thing................see help (bottom of the page)>posting. Need more help let us know.

Edited November 4, 2016 by TomFace

[Chouett 0]

Hello,

 

So this is what happens at random.

 

But the scan keeps coming back clean.

 

Please help.

 

Thank you

 

 

 Esetscanshot.pdf

[itman 1,538]

That is strange. Normally when Eset's Web Filter protection blocks an IP address, it usually states why e.g. blocked by internal IP block list, etc..

 

Check your Eset Filtered Web Sites log for an entry with that IP address. Then copy that log line item and paste it into your reply.

[Chouett 0]

Hi Itman,

 

I found 2:

 

Time;Scanner;Object type;Object;Threat;Action;User;Information;Hash;First seen here

24/10/2016 19:32:30;HTTP filter;file;hxxp://non-block.net/wpad.dat?bc144778120dc73e3e974edcbd59eef316705492;JS/ProxyChanger.BWtrojan;connection terminated;LP-UK\vsbadmin;Threat was detected upon access to web by the application: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (2184EA4822725A0E0DBF206FEA1DD6DBCA47C4C0).;B5D5B6E0E3BC5D85F8DE71E76F1A0B5CDAE308AD;

 

 

Time;Scanner;Object type;Object;Threat;Action;User;Information;Hash;First seen here

24/10/2016 19:32:30;HTTP filter;file;hxxp://non-block.net/wpad.dat?bc144778120dc73e3e974edcbd59eef316705492;JS/ProxyChanger.BWtrojan;connection terminated;LP-UK\vsbadmin;Threat was detected upon access to web by the application: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (2184EA4822725A0E0DBF206FEA1DD6DBCA47C4C0).;B5D5B6E0E3BC5D85F8DE71E76F1A0B5CDAE308AD;

 

 

[Chouett 0]

I should have said,

 

I found 2 different one and one that keeps repeating so I only copied it once.

 

Thank you.

 

Chouett

[Chouett 0]

Here's another one.

 

It looks different from the others.

 

Time;URL;Status;Application;User;IP address;Threat

04/11/2016 18:51:46;hxxp://non-block.net/wpad.dat?bc144778120dc73e3e974edcbd59eef316705492;Blockedby internal blacklist;C:\Windows\System32\svchost.exe;NT AUTHORITY\LOCAL SERVICE;50.7.145.12;

 

Thank you.

 

Chouett

[Marcos 4,705]

Check the setting for automatic proxy server configuration and remove the address that you currently have there.

[Chouett 0]

Ok

 

I have just done that.

 

Let's see what happens

 

Is that ok it the field to remain blank?

 

Chouett

[itman 1,538]

 

Here's another one.

 

It looks different from the others.

 

Time;URL;Status;Application;User;IP address;Threat

04/11/2016 18:51:46;hxxp://non-block.net/wpad.dat?bc144778120dc73e3e974edcbd59eef316705492;Blockedby internal blacklist;C:\Windows\System32\svchost.exe;NT AUTHORITY\LOCAL SERVICE;50.7.145.12;

 

Thank you.

 

Chouett

 

This might be a false positive. The IP scanned clean at a number of IP validation web sites. The only AV vendor at VirusTotal to have issue with URL was Eset.

[Marcos 4,705]

This might be a false positive. The IP scanned clean at a number of IP validation web sites. The only AV vendor at VirusTotal to have issue with URL was Eset.

Likely not a FP. There was also malware detected by a signature (ProxyChanger.BW trojan).

[Chouett 0]

Hello,

The message is still appearing but not as often.

What is an FP?

Chouett

[Chouett 0]

Oh false positive

[Marcos 4,705]

As I wrote, it doesn't seem to be a false positive. Make sure that you have no automatic configuration script set up in the Network settings and the appropriate box is unchecked as shown below:

[Chouett 0]

Thank you so much Team Eset Moderators,

 

It seems to have done the trick.

 

Chouett