- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
01-08-2014 05:37 AM
Since 2013/12/26 I have been seeing a large number of Suspicious DNS Queries (generic: xml12es.farolatino.com), threatid 4011926. After researching the computers that are getting this, they all seem to be going to Microsoft sites prior to this query. From what I have read this seams to be coming from Microsoft Media Player. They use this site for their online media catalog. Has anyone else seen this?
01-08-2014 07:32 AM
Hello Randy Greenspon,
This is a false positive. The signature is now disabled and the fix will be available in AV-1186.
Hope that helps!
Thanks and regards,
Kunal Adak
01-08-2014 07:32 AM
Hello Randy Greenspon,
This is a false positive. The signature is now disabled and the fix will be available in AV-1186.
Hope that helps!
Thanks and regards,
Kunal Adak
01-10-2014 07:59 AM
Thanks for confirming this and I have seen it get removed in AV-1186. However with the addition of AV-1187 we are now getting another, I believe false positive of ThreatID 4034267, generic:msreg.gale.com
01-16-2014 09:37 AM
Hello rgreens,
msreg.gale.com domain is not a false positive. "Wildfire has detected a malware sample (ba491bb1eb3d62c5520883c8a24ac08f) which tried to resolve this domain "msreg.gale.com", which can not be resolved. So a malware sample tried to visit an un-resolvable domain and hence we marked this domain as malware"
Hope that helps!
Thanks and regards,
Kunal Adak
01-20-2014 02:31 AM
Hello rgreens
I also have this problem, DNS queries:
How to fix it?
Thank you,
Diego
01-20-2014 08:07 AM
Diego,
I haven't found a resolution. I am still seeing a lot of the msreg.gale.com. Based on what I can find in Google (not much) I believe this has something to do with Microsoft Word 2007 and language translation. I am seeing others as well, that are listed as Generic, not malware/virus/trojan etc.
Update:
After a little more research it is referenced the same time as the website "Research Web Service." I have also verified this is coming from Microsoft Word 2007, when someone does the Research feature, i.e. word lookup or translation. Does anyone know of a way to not log this as it is filling up our logs ~150 queries/hr.
R
10-27-2014 05:57 AM
UPDATE: I found our issue, the vendor that originally configured this device had not cloned the Anti-spyware profile, as such it was read-only. Once the profile was cloned, an exception could be created.
We are seeing the same activity for a different domain. The threat notification is:
Suspicious DNS Query (generic:rfenkq.com)
Threat ID: 4045717
The source is our internal DNS, the targets are OpenDNS, which we use for DNS filtering and the Google DNS servers 8.8.8.8 and 8.8.4.4
Other than our creating a policy for this, is there a way to exempt this traffic?
We are unable to exempt it via known methods (click on link, add IPs) as the Exempt Profiles column is blank and the 'Ok' button is never enabled to save the exemption.
When listing all of the threats for the security profiles, #4045717 is not in any list (and our patterns are upto date).
10-28-2014 12:35 AM
rgreens, have you tried to exempt this threat if you consider it safe?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!