[Philoslothical]

Hi, I just visited the following link, and my copy of Malwarebytes blocked what it claims is a trojan on what must be an embedded link somewhere in that page. I just want to provide a heads up, I don't need any assistance. Thanks!

HTML Code:

https://www.pentaxforums.com/forums/38-photographic-technique/45759-pentax-movies.html

[mkgd1]

Thanks for the warning

[pjv]

I went through all 24 pages and checked each link.
The only issues I found were a few YouTube videos no longer available, and a couple of 404's.
My Norton 360 gave no warnings or alerts.

I believe the thread to be safe, but thanks for the alert. Better to be safe.

[Philoslothical]

It's the first page of the thread. The malicious link points to

Code:

www.angelfire.com

at IP 209.202.252.41 and it is attempting to connect on port 443, which means it's an ssl link.

If you view page source and ctrl+F "angelfire" you'll find the link following this string of text "If you look really close (Mike!) you'll see faintly that this looks to have the self-timer dial on the top deck... this can ONLY be an H3v/SV..."

That's as much help as I can provide. I'm not too worried about it, but it should be deleted just to be safe.

---

Last edited by Philoslothical; 07-20-2020 at 12:12 AM. Reason: Added a code tag because of the auto-linking feature.

[Adam]

I checked out the link on the first page, it looks like it's a plain old image. Is that the one that got flagged in your case?

[Philoslothical]

I'm no longer receiving a warning on that page. I see the link it suspected is still there, but when I try to access it it's unable to connect to the server, and I think this is why the warning has stopped. I suspect the link doesn't currently point to a legitimate image at all, despite the url. It may point first to an .htaccess file that interprets the request and redirects it to malware. Or it could be a false positive in Malwarebytes, it wouldn't be the first. There's no way to tell while the link is down. There's also little reason to preserve a dead link.

I'm really not trying to make this a bigger thing for you than it is. I understand the difficulties with this stuff, I dealt with it for years in a similar capacity. On my boards and those I maintained I'd default to removing suspicious links ASAP because it's not worth the repeated headaches of dealing with people who try to helpfully report them, like me.

[MarkJerling]

I've run a range of checks on the angelfire image link and can't find anything that indicates any issue. I wonder if it was a false positive in Malwarebytes? (I also run Malwarebytes, but it's not thrown up any warnings for me.)

[BryantCP]

Adam:
Saturday night I was using PentaxForums camera comparison page to compare the new K-3 III with the K-3 and at the bottom of the page there is/was a "continue" button which I clicked on. It led to a series of flashing warnings that implied that my computer was in the process of being "hijacked" and being locked out and to call an 800 number for help. Chrome could not be quit normally thou I was able to by using Control-Alternate-Delete. Afterwards I ran MalwareBytes & ESET which didn't find anything. So I am assuming that it was not much more than malicious java code.

[MarkJerling]

@Adam: Please see post above.

[Adam]

Adam:
Saturday night I was using PentaxForums camera comparison page to compare the new K-3 III with the K-3 and at the bottom of the page there is/was a "continue" button which I clicked on. It led to a series of flashing warnings that implied that my computer was in the process of being "hijacked" and being locked out and to call an 800 number for help. Chrome could not be quit normally thou I was able to by using Control-Alternate-Delete. Afterwards I ran MalwareBytes & ESET which didn't find anything. So I am assuming that it was not much more than malicious java code.

This sounds like either a deceptive banner ad, or perhaps a browser addon that's injecting ads onto your page. If you have a screenshot of what you saw (both here and after clicking) or the URL you visited, that would be very helpful in identifying it and/or getting it blocked by Google.