Malwarebytes alert: feedapi.psccint.com

Slimjet bug reports
danielson
Posts: 89
Joined: Tue Oct 07, 2014 7:27 pm
Location: AR

Malwarebytes alert: feedapi.psccint.com

Post by danielson » Tue Dec 20, 2016 8:34 am

For some reason 64bit version wasn't behaving well so i un-installed and re-installed via web installer.
Now, at every start, i get this alert from Malwarebytes:
feedapi.psccint.com
port: 7178
type: outbound
process: slimjet (x86) etc.

Running version 12.0.13.0
Don't know if web installer does 64bit or 32bit by default, but i wasn't getting this alert from Malwarebytes when 64bit was running.
Also, haven't been using SJ much as of late, so i don't know what could have caused this.

If it's malware, suppose Linux would be the better option hé!

danielson
Posts: 89
Joined: Tue Oct 07, 2014 7:27 pm
Location: AR

Re: Malwarebytes alert: feedapi.psccint.com

Post by danielson » Tue Dec 20, 2016 3:16 pm

Have scanned with AVAST, Total Security (Bitdefender and Avira), Advanced System Care, Rogue Killer, ADW and even Hitman Pro!
Nothing is stopping that alert from Malwarebytes!
Even removed SJ entire profile with Iobit Uninstaller and installed with webinstaller (1st scanned with Virustotal) - still coming up even without syncing to Google account with extensions etc.
Now i just noticed another MB alert, when opening a new tab, if i type a name like "snapfiles" without the .com i get "fpseek.com" alert - what is that? :lol:

RBTB2605
Posts: 347
Joined: Fri Jul 03, 2015 7:06 am

Re: Malwarebytes alert: feedapi.psccint.com

Post by RBTB2605 » Tue Dec 20, 2016 4:53 pm

OK...so what is this exactly ???

I installed Slimjet 32bit latest version just now and this is what Malwarebytes Pro tells me each and every time I open up the browser.

RBTB2605
Posts: 347
Joined: Fri Jul 03, 2015 7:06 am

Re: Malwarebytes alert: feedapi.psccint.com

Post by RBTB2605 » Tue Dec 20, 2016 5:05 pm

When I try to access the IP address, Malwarebytes pops right up and blocks. I am not encourage by any of this.

RBTB2605
Posts: 347
Joined: Fri Jul 03, 2015 7:06 am

Re: Malwarebytes alert: feedapi.psccint.com

Post by RBTB2605 » Tue Dec 20, 2016 5:18 pm

fpseek is malware. I am seeing the same behavior. What the hell is going on with Slimjet now ???

I am uninstalling this browser immediately.

"Fpseek.com is a browser redirect program that can be risky when installed on the computer. This adware can replace home page with unknown search engine. If you are seeing Fpseek.com as part of the browser, it only confirms that it is compromised. Browser hijacking intends to replace your search engine so that it can display ads on home page as well as search results. This can generate revenue for adware authors. However, users have nothing to gain aside from being annoyed by too much display of advertisements. For that ground, many users deemed Fpseek.com as part of virus activity."

danielson
Posts: 89
Joined: Tue Oct 07, 2014 7:27 pm
Location: AR

Re: Malwarebytes alert: feedapi.psccint.com

Post by danielson » Tue Dec 20, 2016 7:14 pm

For once it's not just me.

I'm on dual boot with Antergos right now.
Maybe the spyware would not be effective there?
Was tempted to try it out but after latest post here, i changed my mind.

RBTB2605
Posts: 347
Joined: Fri Jul 03, 2015 7:06 am

Re: Malwarebytes alert: feedapi.psccint.com

Post by RBTB2605 » Tue Dec 20, 2016 7:38 pm

I am just going to stay away from Slimjet for now I think. An explanation from Flashpeak is in order here. Totally uninstalled it from my system. It was quite concerning to me to see that box pop up repeatedly each time I started the browser and I also experienced that other fspeek thing that you did. I take pride in running a clean machine here and I want it to remain that way.

flashpeak
Site Admin
Posts: 361
Joined: Mon Apr 21, 2014 3:57 pm

Re: Malwarebytes alert: feedapi.psccint.com

Post by flashpeak » Tue Dec 20, 2016 10:17 pm

Slimjet comes with a sponsored version of bing search services offered through an intermediate reselling company (Microsoft is too big to be willing to deal directly with a small team like us). The connection to feedapi.psccint.com is supposed to be a one-time call to initialize the search api. However, because the connection was blocked, it ends up doing that every time on startup. If you approve the connection for once, it will not come up again. Per the terms of agreement between FlashPeak, the reselling company and Microsoft, we have to redirect the bing search through an intermediate domain fpseek.com. However, all the search results are directly provided by Microsoft bing search engine.

Here is a copy of the privacy policy associated with Fpseek.com: http://info.fpseek.com/Eula if you have concerns about your privacy.

This is not a recent change. The sponsored bing search has been built into Slimjet for about a year now. It helps keep Slimjet free and actively maintained.

It is NOT malware or spyware. The anti-malware software is inclined to call any sponsored service malware to promote their own value. If you want to avoid fpseek.com completely, you have the full choice to switch to a different search engine. However, we do hope users can support the project by using the sponsored services.

With that said, we will put in some code changes to avoid repeatedly calling the initialization url at psccint.com when the user clearly intends to block it.

Hope this is enough to clarify your questions.
Stephen Cheng
FlashPeak Inc.

danielson
Posts: 89
Joined: Tue Oct 07, 2014 7:27 pm
Location: AR

Re: Malwarebytes alert: feedapi.psccint.com

Post by danielson » Wed Dec 21, 2016 5:32 am

Thank you for the clarification.

Doesn't explain why it isn't happening in 12.0.6.0 though.
Just re-installed via backup image.

danielson
Posts: 89
Joined: Tue Oct 07, 2014 7:27 pm
Location: AR

Re: Malwarebytes alert: feedapi.psccint.com

Post by danielson » Wed Dec 21, 2016 8:29 am

Btw, i scourge the web for info. on those alerts and there was practically nothing to be found.
Has Google lost its touch?
This, and the fact that i went through a slew of different AV and scans just made me more weary about Slimjet's recent "change". :(

Post Reply