• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

Norton regularly blocks a Web Attack: Malvertisement website redirect 10

Hi,

Starting January 2018, Norton frequently captures and blocks a malware from Google Chrome. The message goes like this "an intrusion attempt by 35.184.188.211 was blocked" The details of the attack are as follows -

IPS Alert Name: Web Attack : Malvertisement Website Redirect 10

Default Action: No action required

Attacking computer : 35.184.188.211, 80

Attacker URL : 

"35.184.188.211/NjU3NDA1NDI1NDIyLzY1NzQwNzAyNjU5NS8wZHRzdWE4enVv?stamat=m|,,wiJSoja_tGU3Bf9GH0dEdHP3xP.391,InDgnKXDtGT5C-1ql975Ju_bvf9vhYB0x763_pY-6i2aNr-dMUf8guq6TOOEsoSakdazDcnFa0yvzgl84Ab36QXI_7EtpYUIpLlssVMk3omg8DjFjivgQ7GITAk0T3_5WWN1bPNLjLvqtfF6xZCaGFiW--6AxlRzN58PDpLwd2OEGr31XS2lwZV46RAe3Xomw-h4g4NwJs0Qa-vKH3uODHTUiWstI9IcyupBqKeSWwHNDauTGbey9R0JwSIW8M_jswwPybDjDkyue1QWWIgzuuI3Bu-moK2JBOkGYeEWgmNxIYVRPKGrL-wzbUDaKYRGEFNaBgYbXPYDjYfUdmpaOgHe1b20wnutEAZgJWvomNVn-ds9PM9qVjd6k8lLhZJdX6dJAwEW7n1cD6EqwhDThai4CmMnp8DNSugoKkGJ1D8lv5k6azJIi4crK9Pa1sZM"

I am thankful Norton is doing its job blocking this attack. But I am concerned because this attack is quite regular and from the same source. Whenever I close or click any links of any website sometimes it opens a new window in the same tab with the above url. However, the link does not show any ads or information, normally it shows "the site can't be reached" I am keen to know why this intrusion happens frequently although am doubly sure i didn't open or click spammy links from emails, website, etc. I have already scanned the system completely and nothing out of the ordinary was discovered. Could you please help?

Thanks

Replies

Kudos0

Re: Norton regularly blocks a Web Attack: Malvertisement website redirect 10

Hello Sobin,

At least when i have encountered the "Malvertisement Attack" from my Norton program, i just IMMEDIATELY got off of whatever site had prompted Norton and the alerts stopped.  To be extra safe, perhaps run Malwarebytes: https://www.malwarebytes.com/mwb-download/thankyou/

Sincerely,

H.B. 

Kudos0

Re: Norton regularly blocks a Web Attack: Malvertisement website redirect 10

I do this too. But, the problem is I have to keep doing it every time, even on low-risk sites such as Facebook, Microsoft , etc. It is not always the case, but occurs once in few hours. Once you click a link from a website, in that particular tab, the actual link is opened. But, at the same time, this malware link is opened on a new tab. That's when Norton kicks in and blocks the threat. 

My best assumption is some malware bits are somehow present deep in my drive unseen by Norton. Somehow it gets triggered when browsing,particularly while clicking links. Norton blocking this threat is just a surface action that momentarily fixes the problem. I feel once the underlying threat is fully removed, only then I would stop experiencing this. 

Kudos0

Re: Norton regularly blocks a Web Attack: Malvertisement website redirect 10

Hello

When you do your weekly or monthly system security scan, does this malware come back as exonerated in Norton Community Watch in the History Logs? If it does, then you can relax because it means that you don't have anything to worry about.

If you want to make sure that your computer is clean or infected, you can stop over at one of the free malware removal sites. They will help you test your computer and if it is infected, they will help you to clean it up. They will tell you what scans to run and you report the results of the scans. You can ask as many questions as you want. They will help until your computer is clean again.

Please see this link for an up to date description of these sites plus the addition of a newly listed site formed by one of our successful malware remover users who unfortunately has passed away. That site is still being run by a good expert who happens to be one of the other Gurus.  The new site is listed first in this link.

https://community.norton.com/en/forums/malware-removal-forum-recommendations

Please come back and let us know how you make out. Just pick a site from that list and sign up with them. You may have to wait until they help you.

Have a Good Night and

Thanks.




 

Success always occurs in private and failure in full view. Windows 7 Pro 64 bit NSBU 22.17.0.183 Core Firmware 270 I E 11 Chrome latest one
Kudos0

Re: Norton regularly blocks a Web Attack: Malvertisement website redirect 10

The Malvertisment redirects are usually in malformed ads on a page you are visiting. If you are seeing things from different pages, what could be happening is that all the web sites you see this on are using the same ad service to provide the ads for their page.

The redirects are usually some JavaScript in those ads. They are only executed while you are on that web site. Once you leave the site, the malware is gone. That is why scanning your computer finds nothing.

You can help prevent these redirects by installing  an ad blocker extension in your browser.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: Norton regularly blocks a Web Attack: Malvertisement website redirect 10

@Sobin

Yeah, in my case it was just "oddball" Websites, but, if you're getting this even with benign sites, i would say this is pretty pervasive and you should definitely run the FULL system scan with Malwarebytes' AND might even try Malwarebytes' Anti-Rootkit (MBAR). 

This thread is closed from further comment. Please visit the forum to start a new thread.