« previous next »
Pages: [1]   Go Down

Author Topic: t2.gstatic.com = False Positive or Not???  (Read 12145 times)

0 Members and 1 Guest are viewing this topic.

TailsX360

  • Guest
t2.gstatic.com = False Positive or Not???
« on: August 02, 2011, 02:54:48 AM »
ok seriously, this alert is beginning to piss me off now. >:(

ever since I updated my Avast 6 with the latest major update, every time I go to google image search anything, THIS starts popping up like crazy when I'm scrolling down:



It's always either t1.gstatic.com, t2.gstatic.com, or t3.gstatic.com.
but IT ALWAYS picks up the same thing! and it's not like it's even BLOCKING IMAGES to begin with! it's just a random alert that pops up whenever I'm Google Imaging things.

But at the same time: There are ABSOLUTELY NO SYMPTOMS of infection on my PC.
No Corrupted Files, No Wallpaper Changes, No Random Promptings of Rogue Security Programs, No Blocking of Internet Access, NONE OF THAT!  ???
Nothing is wrong with it at all, and I scan my PC on a weekly basis with not just Avast 6, but also with SUPERantispyware Free Edition, Malwarebytes Anti-Malware, Trend Micro HijackThis and Kaspersky TDS Killer. I make sure my PC is SPOTLESS, since I've had to deal with MBR Rootkits MULTIPLE TIMES in the past.... :P

Nothing BIG is detected on ANY OF THEM tho! and nothing seems to be the matter with my PC at all aside from THIS.

Since this ONLY JUST started happening after the latest Avast update with me, I am 99% Sure that his has GOT 2 BE some kind of False Positive going on here, since Google Images uses that website all the time to load many image results without a problem.

So is it possible that this alert is a false positive? cuz based on nothing being wrong with my PC at all, that's definitely what it seems like from my point of view here....

OR

Is it possible that I MISSED A SPOT and this is actually a Hidden Rootkit's doing that can't do anything due to my insane level of protection but is still somewhat being detected??
« Last Edit: August 02, 2011, 05:36:59 AM by TailsX360 »
Logged

kubecj

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #1 on: August 02, 2011, 09:57:47 AM »
I need you to run command line, from the commandline this command:

nslookup t1.gstatic.com

a then cut'n'paste the results for me - and three times, for t1, t2, t3.


Also check the hosts file for any records regarding this.
It's usually in c:\windows\system32\drivers\etc


Third thing is to check out which dns servers do you use.
Running cmdline again, and this command:
ipconfig /all

and then cut'n'paste your dns servers.

I suspect you'll have there 188.229.88.7 or 188.229.88.8.
« Last Edit: August 02, 2011, 12:26:24 PM by kubecj »
Logged

msgreyberry

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #2 on: August 02, 2011, 07:58:45 PM »
Urlvoid reported them all as clean, but I'm not really sure why avast would do that...
Logged

kubecj

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #3 on: August 02, 2011, 08:02:43 PM »
Because I suspect there is some kind of dns hijack and avast is (by the chance, not by design) reporting it. It's a local problem of a user, not a problem of the sites.
Logged

TailsX360

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #4 on: August 02, 2011, 09:55:51 PM »
Results for nslookup on the 3 gstatic websites:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>nslookup t1.gstatic.com
Server:  UnKnown
Address:  192.168.0.1

Non-authoritative answer:
Name:    t1.gstatic.com
Addresses:  74.125.226.179
          74.125.226.177
          74.125.226.178
          74.125.226.176
          74.125.226.180


C:\Windows\system32>nslookup t2.gstatic.com
Server:  UnKnown
Address:  192.168.0.1

Non-authoritative answer:
Name:    t2.gstatic.com
Addresses:  74.125.226.180
          74.125.226.177
          74.125.226.179
          74.125.226.178
          74.125.226.176


C:\Windows\system32>nslookup t3.gstatic.com
Server:  UnKnown
Address:  192.168.0.1

Non-authoritative answer:
Name:    t3.gstatic.com
Addresses:  74.125.226.178
          74.125.226.179
          74.125.226.176
          74.125.226.177
          74.125.226.180


IPCONFIG Results:


C:\Windows\system32>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : G-Machine
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Marvell Yukon 88E8056 PCI-E Gigabit Ether
net Controller
   Physical Address. . . . . . . . . : 00-22-15-A3-CE-72
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::1586:fdb5:e482:f9fb%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.198(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, August 02, 2011 3:50:22 PM
   Lease Expires . . . . . . . . . . : Wednesday, August 03, 2011 3:50:22 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 301998613
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-FD-0C-9D-00-22-15-A3-DF-E3

   DNS Servers . . . . . . . . . . . : 192.168.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Marvell Yukon 88E8001/8003/8010 PCI Gigab
it Ethernet Controller
   Physical Address. . . . . . . . . : 00-22-15-A3-DF-E3
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection 3:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Hamachi Network Interface
   Physical Address. . . . . . . . . : 7A-79-63-A2-41-CE
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 5.175.192.218(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.0.0.0
   Lease Obtained. . . . . . . . . . : Tuesday, August 02, 2011 3:50:21 PM
   Lease Expires . . . . . . . . . . : Wednesday, August 01, 2012 3:52:28 PM
   Default Gateway . . . . . . . . . : 5.0.0.1
   DHCP Server . . . . . . . . . . . : 5.0.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{0988A8B5-A33D-4B5A-A8E1-8C6F9D4F2831}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{006E1A2B-1547-4FA2-AA8D-1C8AEC0BE0DF}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 12:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:4137:9e76:3c19:35cb:ba8c:7b20(Pref
erred)
   Link-local IPv6 Address . . . . . : fe80::3c19:35cb:ba8c:7b20%14(Preferred)
   Default Gateway . . . . . . . . . :
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{FB806E3F-9F5D-41F8-8426-C8AE6606E8A1}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter 6TO4 Adapter:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft 6to4 Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2002:5af:c0da::5af:c0da(Preferred)
   Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
   NetBIOS over Tcpip. . . . . . . . : Disabled

C:\Windows\system32>
Logged

msgreyberry

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #5 on: August 02, 2011, 10:47:14 PM »
Quote from: kubecj on August 02, 2011, 08:02:43 PM
Because I suspect there is some kind of dns hijack and avast is (by the chance, not by design) reporting it. It's a local problem of a user, not a problem of the sites.

I see what you mean...but I thought adding it there for extra information~
Logged

TailsX360

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #6 on: August 03, 2011, 04:29:02 PM »
I mean, I do notice the infection listed as "URL:MAL", and after looking around on the Avast Support Forums, that type of Malware is usually associated with a Rootkit.
But usually URL:MAL has symptoms of infection that go with it, does it not??
It's true that Alureon is associated with a URL:MAL Infection in some cases, but if it's not even effecting anything on my PC at all, are you sure it's REALLY AN INFECTION or is it just a false positive??

@kubecj

I gave you the info you requested.
So what's the diagnosis from your point of view??
Logged

kubecj

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #7 on: August 03, 2011, 04:54:38 PM »
My diagnosis is, that it should work for you now without a glitch 8) (ie. our fp)
Logged

TailsX360

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #8 on: August 04, 2011, 04:55:11 AM »
CONFIRMED!!! ;D
No more annoying alerts!!

Thanks a bunch for sorting this out, you guys! ;)
AVAST 4 LIFE!!!! 8)
Logged

TailsX360

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #9 on: August 04, 2011, 11:31:28 PM »
APOLOGY FOR DOUBLE POST, but....
apparently I spoke too soon ::)



NOW, whenever I google image search, I'm now also getting alerts about t0.gstatic.com.
That one wasn't popping up before. Last time, it was only t1, t2, and t3.

This all started happening right after my Avast updated its virus definitions when I started up my PC about 20 minutes ago.

Any suggestions???
« Last Edit: August 05, 2011, 06:38:30 PM by TailsX360 »
Logged

kubecj

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #10 on: August 04, 2011, 11:49:15 PM »
Unbelievable...
please nslookup www.google.com for me again :-/
Logged

TailsX360

  • Guest
Re: t2.gstatic.com = False Positive or Not???
« Reply #11 on: August 05, 2011, 12:30:06 AM »
RESULTS:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>nslookup www.google.com
Server:  UnKnown
Address:  192.168.0.1

Non-authoritative answer:
Name:    www.l.google.com
Addresses:  74.125.226.178
          74.125.226.180
          74.125.226.177
          74.125.226.176
          74.125.226.179
Aliases:  www.google.com


C:\Windows\system32>


But wait! It gets even BETTER now! Cuz now I KNOW it's not just me!
My MOM'S PC; which ALSO has Avast was freaking out as well over Google and ALSO YOUTUBE; which still pointed to a link from Google! So now, I'm not the only one seeing this.

I wonder how many others got this problem too....


UPDATE:

I am NOW also getting reports from MY FRIENDS TOO that Avast is going nuts with Google and Google Images with them as well.

UPDATE #2:

Oh, this is just great!
Now YOUTUBE is being effected.... ::)
Probably due to the fact that Youtube is owned by Google.

Maybe essexboy should take a look at our situation and see what's REALLY HAPPENING.
If this is happening on EVERYBODY I KNOW'S PCs, then it can't ALL BE MALWARE.
But maybe a 2nd opinion would be in order here....
« Last Edit: August 05, 2011, 05:49:00 AM by TailsX360 »
Logged
Pages: [1]   Go Up
« previous next »