Forgot Password
Pentax Camera Forums Home
 

Reply
Show Printable Version Search this Thread
07-19-2020, 11:08 PM - 1 Like   #1
Veteran Member
Philoslothical's Avatar

Join Date: May 2011
Posts: 1,797
Malicious link in forum thread

Hi, I just visited the following link, and my copy of Malwarebytes blocked what it claims is a trojan on what must be an embedded link somewhere in that page. I just want to provide a heads up, I don't need any assistance. Thanks!

HTML Code:
https://www.pentaxforums.com/forums/38-photographic-technique/45759-pentax-movies.html


07-19-2020, 11:17 PM   #2
Loyal Site Supporter
Loyal Site Supporter




Join Date: Dec 2019
Location: Mohave county Arizona
Photos: Albums
Posts: 1,055
Thanks for the warning
07-19-2020, 11:46 PM   #3
pjv
Otis Memorial Pentaxian
Moderator
Loyal Site Supporter
pjv's Avatar

Join Date: Mar 2015
Location: Melbourne, Australia
Photos: Gallery
Posts: 7,390
I went through all 24 pages and checked each link.
The only issues I found were a few YouTube videos no longer available, and a couple of 404's.
My Norton 360 gave no warnings or alerts.

I believe the thread to be safe, but thanks for the alert. Better to be safe.
07-20-2020, 12:10 AM   #4
Veteran Member
Philoslothical's Avatar

Join Date: May 2011
Posts: 1,797
Original Poster
It's the first page of the thread. The malicious link points to
Code:
www.angelfire.com
at IP 209.202.252.41 and it is attempting to connect on port 443, which means it's an ssl link.

If you view page source and ctrl+F "angelfire" you'll find the link following this string of text "If you look really close (Mike!) you'll see faintly that this looks to have the self-timer dial on the top deck... this can ONLY be an H3v/SV..."

That's as much help as I can provide. I'm not too worried about it, but it should be deleted just to be safe.


Last edited by Philoslothical; 07-20-2020 at 12:12 AM. Reason: Added a code tag because of the auto-linking feature.
07-20-2020, 01:36 PM   #5
Administrator
Site Webmaster
Adam's Avatar

Join Date: Sep 2006
Location: Arizona
Photos: Gallery | Albums
Posts: 49,785
I checked out the link on the first page, it looks like it's a plain old image. Is that the one that got flagged in your case?

Adam
PentaxForums.com Webmaster (Site Usage Guide | Site Help | My Photography)



PentaxForums.com server and development costs are user-supported. You can help cover these costs by donating. Or, buy your photo gear from our affiliates, Adorama, B&H Photo, KEH, or Topaz Labs, and get FREE Marketplace access - click here to see how! Trusted Pentax retailers:

07-20-2020, 06:00 PM   #6
Veteran Member
Philoslothical's Avatar

Join Date: May 2011
Posts: 1,797
Original Poster
I'm no longer receiving a warning on that page. I see the link it suspected is still there, but when I try to access it it's unable to connect to the server, and I think this is why the warning has stopped. I suspect the link doesn't currently point to a legitimate image at all, despite the url. It may point first to an .htaccess file that interprets the request and redirects it to malware. Or it could be a false positive in Malwarebytes, it wouldn't be the first. There's no way to tell while the link is down. There's also little reason to preserve a dead link.

I'm really not trying to make this a bigger thing for you than it is. I understand the difficulties with this stuff, I dealt with it for years in a similar capacity. On my boards and those I maintained I'd default to removing suspicious links ASAP because it's not worth the repeated headaches of dealing with people who try to helpfully report them, like me.
07-20-2020, 06:39 PM   #7
Moderator
Site Supporter
Loyal Site Supporter
MarkJerling's Avatar

Join Date: May 2012
Location: Wairarapa, New Zealand
Photos: Gallery | Albums
Posts: 14,892
I've run a range of checks on the angelfire image link and can't find anything that indicates any issue. I wonder if it was a false positive in Malwarebytes? (I also run Malwarebytes, but it's not thrown up any warnings for me.)
11-02-2020, 01:49 PM   #8
Forum Member




Join Date: Jan 2007
Location: Indianapolis, IN USA
Posts: 63
Adam:
Saturday night I was using PentaxForums camera comparison page to compare the new K-3 III with the K-3 and at the bottom of the page there is/was a "continue" button which I clicked on. It led to a series of flashing warnings that implied that my computer was in the process of being "hijacked" and being locked out and to call an 800 number for help. Chrome could not be quit normally thou I was able to by using Control-Alternate-Delete. Afterwards I ran MalwareBytes & ESET which didn't find anything. So I am assuming that it was not much more than malicious java code.

11-02-2020, 01:58 PM   #9
Moderator
Site Supporter
Loyal Site Supporter
MarkJerling's Avatar

Join Date: May 2012
Location: Wairarapa, New Zealand
Photos: Gallery | Albums
Posts: 14,892
@Adam: Please see post above.
11-02-2020, 02:48 PM - 1 Like   #10
Administrator
Site Webmaster
Adam's Avatar

Join Date: Sep 2006
Location: Arizona
Photos: Gallery | Albums
Posts: 49,785
QuoteOriginally posted by BryantCP Quote
Adam:
Saturday night I was using PentaxForums camera comparison page to compare the new K-3 III with the K-3 and at the bottom of the page there is/was a "continue" button which I clicked on. It led to a series of flashing warnings that implied that my computer was in the process of being "hijacked" and being locked out and to call an 800 number for help. Chrome could not be quit normally thou I was able to by using Control-Alternate-Delete. Afterwards I ran MalwareBytes & ESET which didn't find anything. So I am assuming that it was not much more than malicious java code.
This sounds like either a deceptive banner ad, or perhaps a browser addon that's injecting ads onto your page. If you have a screenshot of what you saw (both here and after clicking) or the URL you visited, that would be very helpful in identifying it and/or getting it blocked by Google.

Adam
PentaxForums.com Webmaster (Site Usage Guide | Site Help | My Photography)



PentaxForums.com server and development costs are user-supported. You can help cover these costs by donating. Or, buy your photo gear from our affiliates, Adorama, B&H Photo, KEH, or Topaz Labs, and get FREE Marketplace access - click here to see how! Trusted Pentax retailers:

Reply

Bookmarks
  • Submit Thread to Facebook Facebook
  • Submit Thread to Twitter Twitter
  • Submit Thread to Digg Digg
Tags - Make this thread easier to find by adding keywords to it!
link, link in forum
Thread Tools Search this Thread
Search this Thread:

Advanced Search


Similar Threads
Thread Thread Starter Forum Replies Last Post
A malicious chap Bromid Monthly Photo Contests 0 01-04-2015 11:02 PM
a DPR forum link to here worked?! jimr-pdx General Talk 6 02-10-2014 03:54 PM
Suggestion K-30 forum link on main page WillWeaverRVA Site Suggestions and Help 3 07-19-2012 08:17 PM
Suggestion Please add lens forum to quick link djc737 Site Suggestions and Help 2 04-10-2012 01:49 PM



All times are GMT -7. The time now is 01:49 PM. | See also: NikonForums.com, CanonForums.com part of our network of photo forums!
  • Red (Default)
  • Green
  • Gray
  • Dark
  • Dark Yellow
  • Dark Blue
  • Old Red
  • Old Green
  • Old Gray
  • Dial-Up Style
Hello! It's great to see you back on the forum! Have you considered joining the community?
register
Creating a FREE ACCOUNT takes under a minute, removes ads, and lets you post! [Dismiss]
Top