Since 2013/12/26 I have been seeing a large number of Suspicious DNS Queries (generic: xml12es.farolatino.com), threatid 4011926. After researching the computers that are getting this, they all seem to be going to Microsoft sites prior to this query. From what I have read this seams to be coming from Microsoft Media Player. They use this site for their online media catalog. Has anyone else seen this?
Solved! Go to Solution.
Thanks for confirming this and I have seen it get removed in AV-1186. However with the addition of AV-1187 we are now getting another, I believe false positive of ThreatID 4034267, generic:msreg.gale.com
msreg.gale.com domain is not a false positive. "Wildfire has detected a malware sample (ba491bb1eb3d62c5520883c8a24ac08f) which tried to resolve this domain "msreg.gale.com", which can not be resolved. So a malware sample tried to visit an un-resolvable domain and hence we marked this domain as malware"
Hope that helps!
Thanks and regards,
I also have this problem, DNS queries:
How to fix it?
I haven't found a resolution. I am still seeing a lot of the msreg.gale.com. Based on what I can find in Google (not much) I believe this has something to do with Microsoft Word 2007 and language translation. I am seeing others as well, that are listed as Generic, not malware/virus/trojan etc.
After a little more research it is referenced the same time as the website "Research Web Service." I have also verified this is coming from Microsoft Word 2007, when someone does the Research feature, i.e. word lookup or translation. Does anyone know of a way to not log this as it is filling up our logs ~150 queries/hr.
UPDATE: I found our issue, the vendor that originally configured this device had not cloned the Anti-spyware profile, as such it was read-only. Once the profile was cloned, an exception could be created.
We are seeing the same activity for a different domain. The threat notification is:
Suspicious DNS Query (generic:rfenkq.com)
Threat ID: 4045717
The source is our internal DNS, the targets are OpenDNS, which we use for DNS filtering and the Google DNS servers 22.214.171.124 and 126.96.36.199
Other than our creating a policy for this, is there a way to exempt this traffic?
We are unable to exempt it via known methods (click on link, add IPs) as the Exempt Profiles column is blank and the 'Ok' button is never enabled to save the exemption.
When listing all of the threats for the security profiles, #4045717 is not in any list (and our patterns are upto date).
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!