0

I received some waring that my 'PC' might be infected because it supposedly tried to connect to two ransomware server:

http://45.33.9.234/
http://79.170.40.167/

In practice I have a MBP with MacOS 10.12.6 Malwarebytes cannot find anything. I am on a network but to print I need to switch to a different one, and I get these warning only when I switch to the printing network. I am at loss why

  1. I get the warning to start with
  2. I get warnings only when I am on a specific network and not in the other

So, how do I check what is going on? Get little snitch and keep an eye on what is doing what? any other way to scan the system that is better than Malwarebytes? Any log I can look into?

|improve this question
  • 1
    Can you add a screenshot of the warning? – nohillside♦ Jul 31 '17 at 14:30
  • It is an email from the IT team – user1256923 Jul 31 '17 at 14:33
  • verbatim: Type malware (technical log): ET CNC Ransomware Tracker Reported CnC Server group 96 connection to 45.33.9.234 li963-234.members.linode.com country US – user1256923 Jul 31 '17 at 14:33
  • 2
    Ok, I assume the message is genuine then (aka you've verified that it is indeed from your internal IT team). Installing Little Snitch seems to be a good place to start, should through a message for any outbound connection. – nohillside♦ Jul 31 '17 at 14:34
  • aren't outbound connections logged in any way? – user1256923 Jul 31 '17 at 15:00
1

You receive this message when switching to only this network because it is likely your IT dept have a monitoring tool set upon it, which is using an API with this IP blacklisted for ransomware activity

The problem is this IP is shared across thousands of URLs and only a select few may be associated with ransomware

|improve this answer
  • I am aware of all the above, yet I am concerned the shared IP suggests these websites could be eventually used to serve malware – user1256923 Aug 15 '17 at 6:11
0

Ok, so Little Snitch identified where the connections come from -- my RSS reader (Vienna). The questions is, can one be infected with ransomware or allied annoyances because the RSS feed reader connects to a site that has something to do with said ransomware?

PS for those curious to know, the feed are:

www.thejoinersapprentice.com
www.holteyplanes.com

The first site seems to be dead but the second is alive and apparently 100% legit.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .