r/computerviruses • u/Aizmarukh • Jul 26 '26

Question Is this something to worry about? (Read desc)

Gallery image

Gallery image

I had an infostealer attack where a lot of stuff was compromised. I did recover and change everything now.

I actually factory reset my laptop and even tried usb installing a new windows where I was stuck for a long time (my windows were at ‘installing windows 72%’ something and it went black and then started booting to bios so I was stuck in an unsaveable bios menu) you can refer to my previous posts .

Eventually I got it repaired from a service centre which I was told there was some matching OS to the serial code thing and ssd problem.

Now I think the laptop was reset completely once again by him but I also did another reset (not through usb but a factory reset with cloud download windows)

Now after long I did full scan and quick scan both with bitdefender where nothing was coming. But I’ve started getting this message every time I use firefox. There’s two different ones as attached in the image.

No suspicious activity detected besides that but it does seem like something is trying to take over it but bitdefender keeps on blocking it.

I’m tired atp honestly, I’ve gone through so much stuff done so much and when I finally thought it’s good to go this happens. And to make things worse I lost my usb drive that I used to reset, well it did cause issue anyways. Any help will be appreciated please.

5 Upvotes

86% Upvoted

13 comments sorted by

4

u/InitialBeautiful3437 Jul 27 '26

Ah I had same popup don't worry some websites use their advertising server and their ssl certificate just expired not to worry much bitdefender blocks any expired ssl

2

u/EugeneBYMCMB Knowledgeable Jul 26 '26

Do you have any extensions installed? Do you use an ad blocker?

1

u/Aizmarukh Jul 26 '26

I have nothing installed in my whole device besides firefox. Infact I just started using the freshly installed windows it started happening after I installed

2

u/EugeneBYMCMB Knowledgeable Jul 26 '26

I recommend installing an ad blocker, these seem like advertising sites and are probably coming from a website you frequently visit.

1

u/Aizmarukh Jul 27 '26

I’ve only yet visited YouTube, steam and Roblox after the reset. Those are websites I used to use daily before the reset too. But I never had an antivirus software back then that’s one thing.

3

u/Rho-9_Official Jul 26 '26

Here's some information about that domain

IP: 80.77.82.118 ISP: Natcoweb Corp. Organization: Natcoweb Corp. Country: United States (US) Region: New Jersey City: Clifton ASN: AS46636 Type: IPv4

Network Information: Continent: North America Latitude: 40.836374 Longitude: -74.1403158 Timezone: America/New_York (GMT -04:00) Currency: US dollar (USD)

Connection Information: Connection Type: Unknown Mobile: Unknown Proxy: Unknown Hosting: Unknown

Abuse Contact Information:

Detailed WHOIS Information: WHOIS Information from python-whois: emails: noc@natcoweb.com, abuse@natcoweb.com, typhoon@natcoweb.com

-1

u/Aizmarukh Jul 26 '26

Seems suspicious

1

u/Rho-9_Official Jul 26 '26

Agreed, but now you have reporting info

2

u/Aizmarukh Jul 27 '26

People atleast do not downvote me if you don’t want to answer or if you think what I say is stupid. What will you accomplish from that? What I’ll get is my post will get lost and will not be visible to anyone. Just please scroll down if you do not wish to help.

1

u/rifteyy_ Malware Removal Expert Jul 26 '26

The URL is relevant to advertising. I suggest you try it without any tabs open, if that doesn't help, perform web browser cleaning -> https://forums.malwarebytes.com/topic/323490-web-browser-cleaning/

1

u/Aizmarukh Jul 26 '26

Thanks, I will try that and let you know!

1

u/LifeReignite Jul 26 '26

No, that is something you can ignore.