Question Malware infection?

**lm4187** · 06-11-2015, 05:12 AM

Avast! webshield is giving me a malware block when I access most pages of the forum. The error message is: "http://23.235.39.129/js/<shifting random number>.skimlinks.js"; Infection: "URL:Mal"

Happens with Firefox and Chrome, but not Opera.

Is this a valid block or a false positive, Adam?

Cheers,
Lou

vonBaloney · 06-11-2015, 07:23 AM

Skimlinks is for affiliate marketing I think? I do see that present in the source code on this site, so it probably is a false alarm. (I don't get any alerts anyway.)

Rupert · 06-11-2015, 07:25 AM

Sounds like another renegade squirrel got loose on here to me......maybe Adam has another answer for you, but meanwhile I will drag out the traps again and see what I can do for you!

Best Regards!

Sunflower seeds will trap them every time!

Not a Number · 06-11-2015, 09:08 AM

I use both FireFox and Avast! and have not been getting these warnings. I do have a tracker/ad blocker (Ghostery) and a cookie manager (Cookie Monster) added on to FireFox however.

I am on the latest release version of Firefox. Suggest you make sure FireFox is current and run full scans with Avast! and another scanner such as Malawarebytes.

stevebrot · 06-11-2015, 09:52 AM

The scripts that support the affiliate links are specific to the sites being serviced and are served out of a queue maintained by the company that provides the ads. (The scripts are served from an outside server.) I suspect that one or more of those ads linked to IP addresses with a known danger potential or that there are dangerous elements (usually malformed URLs) in the scripts themselves and that the ad provider has since pulled those ads from the queue.

Steve

Adam · 06-11-2015, 09:57 AM

The skimlinks script on the forum shouldn't have a rotating random number and it should be served from s.skimlinks.com. That IP could be one of their CDN's, but I would recommend checking your browser for any adware or malicious add-ons that might be injecting the script. If you don't find any, it's probably a false positive.

**lm4187** · 06-11-2015, 10:14 AM

AdBlocker+ seems to have solved the problem. For some reason I had turned it off (or one of the renegade squirrels outside my front door).

Thanks,
Lou

06-11-2015, 05:12 AM	#1
lm4187 Site Supporter Join Date: Jul 2009 Location: Germantown MD Posts: 90	Malware infection? Avast! webshield is giving me a malware block when I access most pages of the forum. The error message is: "http://23.235.39.129/js/<shifting random number>.skimlinks.js"; Infection: "URL:Mal" Happens with Firefox and Chrome, but not Opera. Is this a valid block or a false positive, Adam? Cheers, Lou

06-11-2015, 09:57 AM	#6
Adam Administrator Site Webmaster Join Date: Sep 2006 Location: Arizona Photos: Gallery \| Albums Posts: 51,608	The skimlinks script on the forum shouldn't have a rotating random number and it should be served from s.skimlinks.com. That IP could be one of their CDN's, but I would recommend checking your browser for any adware or malicious add-ons that might be injecting the script. If you don't find any, it's probably a false positive. Adam PentaxForums.com Webmaster (Site Usage Guide \| Site Help \| My Photography) PentaxForums.com server and development costs are user-supported. You can help cover these costs by donating or purchasing one of our Pentax eBooks. Or, buy your photo gear from our affiliates, Adorama, B&H Photo, KEH, or Topaz Labs, and get FREE Marketplace access - click here to see how! Trusted Pentax retailers:

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Suggestion Stop the FF infection ... of the other threads - read on.	jpzk	Site Suggestions and Help	59	03-18-2015 11:30 AM
Religious Sites are Worst for Malware	boriscleto	General Talk	4	05-01-2012 04:07 PM
Coming soon: Malware in batteries	RioRico	General Talk	9	07-26-2011 02:56 AM

06-11-2015, 07:23 AM	#2
vonBaloney Pentaxian Join Date: Oct 2011 Location: Albuquerque, NM Posts: 6,029	Skimlinks is for affiliate marketing I think? I do see that present in the source code on this site, so it probably is a false alarm. (I don't get any alerts anyway.)

06-11-2015, 07:25 AM	#3
Rupert Veteran Member Join Date: Sep 2006 Location: Texas Photos: Gallery \| Albums Posts: 25,123	Sounds like another renegade squirrel got loose on here to me......maybe Adam has another answer for you, but meanwhile I will drag out the traps again and see what I can do for you! Best Regards! Sunflower seeds will trap them every time!

06-11-2015, 09:08 AM	#4
Not a Number Moderator Join Date: Mar 2012 Location: Venice, CA Posts: 10,526	I use both FireFox and Avast! and have not been getting these warnings. I do have a tracker/ad blocker (Ghostery) and a cookie manager (Cookie Monster) added on to FireFox however. I am on the latest release version of Firefox. Suggest you make sure FireFox is current and run full scans with Avast! and another scanner such as Malawarebytes.

06-11-2015, 09:52 AM	#5
stevebrot Otis Memorial Pentaxian Join Date: Mar 2007 Location: Vancouver (USA) Photos: Gallery \| Albums Posts: 42,007	The scripts that support the affiliate links are specific to the sites being serviced and are served out of a queue maintained by the company that provides the ads. (The scripts are served from an outside server.) I suspect that one or more of those ads linked to IP addresses with a known danger potential or that there are dangerous elements (usually malformed URLs) in the scripts themselves and that the ad provider has since pulled those ads from the queue. Steve

06-11-2015, 10:14 AM	#7
lm4187 Site Supporter Join Date: Jul 2009 Location: Germantown MD Posts: 90 Original Poster	AdBlocker+ seems to have solved the problem. For some reason I had turned it off (or one of the renegade squirrels outside my front door). Thanks, Lou