Legit Suspicious DNS Query?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Legit Suspicious DNS Query?

L2 Linker

Since 2013/12/26 I have been seeing a large number of Suspicious DNS Queries (generic: xml12es.farolatino.com), threatid 4011926.  After researching the computers that are getting this, they all seem to be going to Microsoft sites prior to this query.  From what I have read this seams to be coming from Microsoft Media Player.  They use this site for their online media catalog.  Has anyone else seen this?

1 accepted solution

Accepted Solutions

L5 Sessionator

Hello Randy Greenspon,

This is a false positive. The signature is now disabled and the fix will be available in AV-1186.

Hope that helps!

Thanks and regards,

Kunal Adak

View solution in original post

7 REPLIES 7

L5 Sessionator

Hello Randy Greenspon,

This is a false positive. The signature is now disabled and the fix will be available in AV-1186.

Hope that helps!

Thanks and regards,

Kunal Adak

Thanks for confirming this and I have seen it get removed in AV-1186.  However with the addition of AV-1187  we are now getting another, I believe false positive of ThreatID 4034267, generic:msreg.gale.com

Hello rgreens,

msreg.gale.com domain is not a false positive. "Wildfire has detected a malware sample (ba491bb1eb3d62c5520883c8a24ac08f) which tried to resolve this domain "msreg.gale.com", which can not be resolved. So a malware sample tried to visit an un-resolvable domain and hence we marked this domain as malware"

Hope that helps!

Thanks and regards,

Kunal Adak

L4 Transporter

Hello rgreens


I also have this problem, DNS queries:


  • msreg.gale.com
  • lb-1.ezakus.net
  • track.yeshj.com
  • api28.thetrafficstat.net
  • pix.trafficjoint.com
  • file.soft365.com
  • ...
  • ..

How to fix it?

Thank you,


Diego

Diego,

I haven't found a resolution.  I am still seeing a lot of the msreg.gale.com.  Based on what I can find in Google (not much) I believe this has something to do with Microsoft Word 2007 and language translation.  I am seeing others as well, that are listed as Generic, not malware/virus/trojan etc.

Update:

After a little more research it is referenced the same time as the website "Research Web Service." I have also verified this is coming from Microsoft Word 2007, when someone does the Research feature, i.e. word lookup or translation.  Does anyone know of a way to not log this as it is filling up our logs ~150 queries/hr.

R

UPDATE: I found our issue, the vendor that originally configured this device had not cloned the Anti-spyware profile, as such it was read-only. Once the profile was cloned, an exception could be created.

We are seeing the same activity for a different domain. The threat notification is:

Suspicious DNS Query (generic:rfenkq.com)

Threat ID: 4045717

The source is our internal DNS, the targets are OpenDNS, which we use for DNS filtering and the Google DNS servers 8.8.8.8 and 8.8.4.4

Other than our creating a policy for this, is there a way to exempt this traffic?

We are unable to exempt it via known methods (click on link, add IPs) as the Exempt Profiles column is blank and the 'Ok' button is never enabled to save the exemption.

When listing all of the threats for the security profiles, #4045717 is not in any list (and our patterns are upto date).

pa1.JPG

rgreens, have you tried to exempt this threat if you consider it safe?

exempt.PNG

  • 1 accepted solution
  • 6821 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!