Malware

2017-04-04 06:03:57

I am a new member to the forum but not a new foobar user. I have created a few skins which I have uploaded to deviantart under user name kjc66 so I know a a bit about how foobar works. The issue I am having is that when I am using certain skins that I have downloaded, every time a song plays, malwarebytes Premium blocks an outgoing connection called survey-winner.net.

It only happens when a song begins to play and malwarebytes blocks the outgoing survey-winner.net twice, when the next tract plays it happens all over again. This is only related to foobar and to be clear the skins I download are extracted in a new portable installation. It is not malware on my system. I don't think it matters but I am using Windows 10 Pro.
An example of a skin that does this is SAPPHIRE iTech 1.11

Anyone else have experience with this and if so how have you dealt with it? Obviously I can keep allowing malwarebytes to block the connection or I can just not use the effected skins but there has to be a better solution. I have looked at files and settings but I am not the greatest with script and I cannot locate anything specific to survey-winner.net but I could be missing something.

Re: Malware

Reply #1 – 2017-04-04 06:22:25

Are you downloading foobar2000 from http://www.foobar2000.org/ and then applying the skin or is the whole thing bundled?

Re: Malware

Reply #2 – 2017-04-04 06:33:10

Yes, I download from  http://www.foobar2000.org/ and just extract the the skin into the foobar portable folder. I also have foobar installed on my system but for skins I download I like to place in a portable installation.

Re: Malware

Reply #3 – 2017-04-04 06:47:35

Probably best thing to do is contact the author like you have done. i wouldn't touch this skin with a barge pole, lots of outdated plugins.

Re: Malware

Reply #4 – 2017-04-04 08:05:31

foo_uie_lyrics3 is making requests to a ip address blacklisted by Malwarebytes... Disabling "Online DB: lyrics.mirkforce.net" (at least with the version included in that skin, might be different in the latest Lyric show panel...) from the options stopped all connections to ip 184.172.106.42 in Wireshark.

The_Vern should remove that server from the component.

Re: Malware

Reply #5 – 2017-04-04 16:28:47

Thanks everyone. It was the foo_ui_lyrics3 that was the culprit. I removed the old version and installed the newer version which solved the problem.
Mr. Man Eating Duck your advice is sound. It is not really a skin I would use but I downloaded it so I can get an idea of how things are put together. I am trying to learn how to skin but so far all I learnt is that I suck.