Legit Suspicious DNS Query?

[rgreens]

Since 2013/12/26 I have been seeing a large number of Suspicious DNS Queries (generic: xml12es.farolatino.com), threatid 4011926.  After researching the computers that are getting this, they all seem to be going to Microsoft sites prior to this query.  From what I have read this seams to be coming from Microsoft Media Player.  They use this site for their online media catalog.  Has anyone else seen this?

[kadak · Accepted solution]

Hello Randy Greenspon,

This is a false positive. The signature is now disabled and the fix will be available in AV-1186.

Hope that helps!

Thanks and regards,

Kunal Adak

[rgreens]

Thanks for confirming this and I have seen it get removed in AV-1186.  However with the addition of AV-1187  we are now getting another, I believe false positive of ThreatID 4034267, generic:msreg.gale.com

[kadak]

Hello rgreens,

msreg.gale.com domain is not a false positive. "Wildfire has detected a malware sample (ba491bb1eb3d62c5520883c8a24ac08f) which tried to resolve this domain "msreg.gale.com", which can not be resolved. So a malware sample tried to visit an un-resolvable domain and hence we marked this domain as malware"

Hope that helps!

Thanks and regards,

Kunal Adak

[SOC_CSG]

Hello rgreens

I also have this problem, DNS queries:

• msreg.gale.com
• lb-1.ezakus.net
• track.yeshj.com
• api28.thetrafficstat.net
• pix.trafficjoint.com
• file.soft365.com
• ...
• ..

How to fix it?

Thank you,

Diego

[rgreens]

Diego,

I haven't found a resolution.  I am still seeing a lot of the msreg.gale.com.  Based on what I can find in Google (not much) I believe this has something to do with Microsoft Word 2007 and language translation.  I am seeing others as well, that are listed as Generic, not malware/virus/trojan etc.

Update:

After a little more research it is referenced the same time as the website "Research Web Service." I have also verified this is coming from Microsoft Word 2007, when someone does the Research feature, i.e. word lookup or translation.  Does anyone know of a way to not log this as it is filling up our logs ~150 queries/hr.

R

[HFITReg]

UPDATE: I found our issue, the vendor that originally configured this device had not cloned the Anti-spyware profile, as such it was read-only. Once the profile was cloned, an exception could be created.

We are seeing the same activity for a different domain. The threat notification is:

Suspicious DNS Query (generic:rfenkq.com)

Threat ID: 4045717

The source is our internal DNS, the targets are OpenDNS, which we use for DNS filtering and the Google DNS servers 8.8.8.8 and 8.8.4.4

Other than our creating a policy for this, is there a way to exempt this traffic?

We are unable to exempt it via known methods (click on link, add IPs) as the Exempt Profiles column is blank and the 'Ok' button is never enabled to save the exemption.

When listing all of the threats for the security profiles, #4045717 is not in any list (and our patterns are upto date).

[JanisM]

rgreens, have you tried to exempt this threat if you consider it safe?