FFS Phones Home

Discuss new features and functions
hotwheelzffx
Posts: 3
Joined: 17 Mar 2019

Post by hotwheelzffx • 17 Mar 2019, 13:18

I don't have FreeFileSync running but my desktop is trying to hit freefilesync.org every couple of minutes.
Capture.PNG
You do not have the required permissions to view the files attached to this post.
Last edited by hotwheelzffx on 18 Mar 2019, 13:29, edited 1 time in total.

User avatar
Zenju
Site Admin
Posts: 4804
Joined: 9 Dec 2007

Post by Zenju • 17 Mar 2019, 17:43

Hm, sounds scary :D
Maybe your tool also knows where these requests are coming from.

hotwheelzffx
Posts: 3
Joined: 17 Mar 2019

Post by hotwheelzffx • 17 Mar 2019, 18:09

The screenshot is Pi-Hole doing DNS requests/blocking. It only shows the machines, not the process. I do not see any process in the task manager related to freefilesync that would be pinging this domain every two minutes.

User avatar
Zenju
Site Admin
Posts: 4804
Joined: 9 Dec 2007

Post by Zenju • 17 Mar 2019, 19:07

If you'd use a tool like Process Monitor, it should be easy to find out.

User avatar
Fmslick
Posts: 3
Joined: 17 Mar 2019

Post by Fmslick • 17 Mar 2019, 19:53

Hey guy,

Yeah I am new here to the forum and really just joined to see where this go's due to I have been running FFS for the last 2-4 yrs (I think, its been some time) now and have never see it phone home to freefilesync.org. Now maybe to something like xx.xxx.xxx.xxx.sub-domain.here to see if there is an update or something like that but really what is FFS really going to get from just ping home + its free :) ...

Anyhow I am not saying @hotwheelzffx is wrong or anything but I do thing there is something more going on , on your comput yo! and if I am reading your SS right than FFS is "calling home" every 14 seconds give or take (last 4 from the top: 3-17-19 9:10:55 / 3-17-19 9:10:41 & 3-17-19 9:08:41 / 3-17-19 9:08:55) and I have never seen FFS "phone home" like that in any logs before.

FFS you guys rock <3 lol :p

hotwheelzffx
Posts: 3
Joined: 17 Mar 2019

Post by hotwheelzffx • 20 Mar 2019, 02:54

Following up. I had freefilesync.org whitelisted in MalwareBytes. MBAM continually queries whitelisted domains. Removing the entry in the whitelist kills the constant DNS queries to the domain. Thanks all.

User avatar
Fmslick
Posts: 3
Joined: 17 Mar 2019

Post by Fmslick • 20 Mar 2019, 13:46

hotwheelzffx,

So MalwareBytes was ping freefilesync.org ? That is even more odd to me but it is what it is.. Happy to hear you got it all worked out.

User avatar
Zenju
Site Admin
Posts: 4804
Joined: 9 Dec 2007

Post by Zenju • 20 Mar 2019, 13:48

Sounds like a DDOS attack by Malwarebytes :D

User avatar
Fmslick
Posts: 3
Joined: 17 Mar 2019

Post by Fmslick • 20 Mar 2019, 13:54

Zenju,

That's funny to think about "Malwarebytes DDoS'n freefilesync.org" lulz :p