Page 1 of 2

Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 8:34 am
by danielson
For some reason 64bit version wasn't behaving well so i un-installed and re-installed via web installer.
Now, at every start, i get this alert from Malwarebytes:
feedapi.psccint.com
port: 7178
type: outbound
process: slimjet (x86) etc.

Running version 12.0.13.0
Don't know if web installer does 64bit or 32bit by default, but i wasn't getting this alert from Malwarebytes when 64bit was running.
Also, haven't been using SJ much as of late, so i don't know what could have caused this.

If it's malware, suppose Linux would be the better option hé!

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 3:16 pm
by danielson
Have scanned with AVAST, Total Security (Bitdefender and Avira), Advanced System Care, Rogue Killer, ADW and even Hitman Pro!
Nothing is stopping that alert from Malwarebytes!
Even removed SJ entire profile with Iobit Uninstaller and installed with webinstaller (1st scanned with Virustotal) - still coming up even without syncing to Google account with extensions etc.
Now i just noticed another MB alert, when opening a new tab, if i type a name like "snapfiles" without the .com i get "fpseek.com" alert - what is that? :lol:

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 4:53 pm
by RBTB2605
OK...so what is this exactly ???

I installed Slimjet 32bit latest version just now and this is what Malwarebytes Pro tells me each and every time I open up the browser.

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 5:05 pm
by RBTB2605
When I try to access the IP address, Malwarebytes pops right up and blocks. I am not encourage by any of this.

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 5:18 pm
by RBTB2605
fpseek is malware. I am seeing the same behavior. What the hell is going on with Slimjet now ???

I am uninstalling this browser immediately.

"Fpseek.com is a browser redirect program that can be risky when installed on the computer. This adware can replace home page with unknown search engine. If you are seeing Fpseek.com as part of the browser, it only confirms that it is compromised. Browser hijacking intends to replace your search engine so that it can display ads on home page as well as search results. This can generate revenue for adware authors. However, users have nothing to gain aside from being annoyed by too much display of advertisements. For that ground, many users deemed Fpseek.com as part of virus activity."

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 7:14 pm
by danielson
For once it's not just me.

I'm on dual boot with Antergos right now.
Maybe the spyware would not be effective there?
Was tempted to try it out but after latest post here, i changed my mind.

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 7:38 pm
by RBTB2605
I am just going to stay away from Slimjet for now I think. An explanation from Flashpeak is in order here. Totally uninstalled it from my system. It was quite concerning to me to see that box pop up repeatedly each time I started the browser and I also experienced that other fspeek thing that you did. I take pride in running a clean machine here and I want it to remain that way.

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Tue Dec 20, 2016 10:17 pm
by flashpeak
Slimjet comes with a sponsored version of bing search services offered through an intermediate reselling company (Microsoft is too big to be willing to deal directly with a small team like us). The connection to feedapi.psccint.com is supposed to be a one-time call to initialize the search api. However, because the connection was blocked, it ends up doing that every time on startup. If you approve the connection for once, it will not come up again. Per the terms of agreement between FlashPeak, the reselling company and Microsoft, we have to redirect the bing search through an intermediate domain fpseek.com. However, all the search results are directly provided by Microsoft bing search engine.

Here is a copy of the privacy policy associated with Fpseek.com: http://info.fpseek.com/Eula if you have concerns about your privacy.

This is not a recent change. The sponsored bing search has been built into Slimjet for about a year now. It helps keep Slimjet free and actively maintained.

It is NOT malware or spyware. The anti-malware software is inclined to call any sponsored service malware to promote their own value. If you want to avoid fpseek.com completely, you have the full choice to switch to a different search engine. However, we do hope users can support the project by using the sponsored services.

With that said, we will put in some code changes to avoid repeatedly calling the initialization url at psccint.com when the user clearly intends to block it.

Hope this is enough to clarify your questions.

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Wed Dec 21, 2016 5:32 am
by danielson
Thank you for the clarification.

Doesn't explain why it isn't happening in 12.0.6.0 though.
Just re-installed via backup image.

Re: Malwarebytes alert: feedapi.psccint.com

Posted: Wed Dec 21, 2016 8:29 am
by danielson
Btw, i scourge the web for info. on those alerts and there was practically nothing to be found.
Has Google lost its touch?
This, and the fact that i went through a slew of different AV and scans just made me more weary about Slimjet's recent "change". :(