4

I recently browsed to apple.com; and the page crashed a few times, then after I reloaded I was given this alert after my browser attempted to redirect to res://ieframe.dll/acr_error.htm#apple.com,http://www.apple.com/:

alert dialogue

Is this cause for concern, or a false alarm?

nslookup apple.com provides

Server:  UnKnown
Address:  192.168.1.1

Non-authoritative answer:
Name:    apple.com
Addresses:  17.142.160.59
          17.178.96.59
          17.172.224.47
6
  • 1
    Definitely something to be concerned about. What does "nslookup apple.com" give when ran in the command prompt ? I suspect a rogue DNS server redirected you to a malicious website (and in the long term, something equally concerning is that you're using Internet Explorer as your browser). Aug 27, 2015 at 2:06
  • @AndréB. I appended my question with the output you requested. I do have Firefox installed I just keep forgetting to use it.
    – motoku
    Aug 27, 2015 at 2:09
  • Those are Apple's IPs: tcpiputils.com/browse/ip-address/17.142.160.59
    – schroeder
    Aug 27, 2015 at 2:37
  • 1
    @MotokoKusanagi the easiest way to remember to use firefox is deleting internet explorer ;)
    – Nic Barker
    Aug 27, 2015 at 3:01
  • @MotokoKusanagi would you be able to make the same request in Firefox and see what happens? It sounds like something malicious is hooking into IE.
    – Nic Barker
    Aug 27, 2015 at 3:06

2 Answers 2

1

Nothing is sure that apple.com website has been the vector attack. The problem could be coming from any tag, window or web pageyou opened using Interet Explorer.

Given the warning message you got, I highly suspect your IE browser is vulnerable to a recent (July 2015) critical issue (Microsoft Security Bulletin MS15-065 - Critical) concerning IE versions through 6 to 11. The warning message says a webpage you have visited (not necessarily apple.com, as I said) has been attempting to remotely execute arbitrary code on your machine by exploiting vulnerabilities of your IE browser. You need to patch your browser and perform (apparently your AV protected you, but scanning again your machine won't harm you).

1
  • Is there an exploit or POC for ms15-065?
    – atdre
    Dec 1, 2015 at 20:11
1

While the alert is alarming, based on the information provided, it does not appear to be of concern.

When IE restarted, it attempted to reopen the page it was last on, which was apple.com. res://ieframe.dll/... is how IE reloads the last page it was on. Malware Bytes caught this dll loading and alerted on it.

4
  • SysWOW64 is the backward compatibility module for 32 bit applications running on 64 bit machines, any idea why it would be hooking in here?
    – Nic Barker
    Aug 27, 2015 at 3:28
  • 1
    Not really. :/ Without knowing the version of Windows and IE, I can only guess.
    – user79537
    Aug 27, 2015 at 3:37
  • agree! Malware byte did not identify an exploit but a suspicious activity. False positive Aug 27, 2015 at 8:39
  • @HexTitan It is IE 11.
    – motoku
    Aug 27, 2015 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .