RE: Trojan Warning - 2

Thanks for your help with this. The pictures have now come back in Chrome, but I get the warning every time I open the editor to post, and also when I submit the post. This is when using the new Edge browser. Unlike the previous version this actually uses the open source Chromium engine which also forms the basis of Google's Chrome browser, so a browser problem afflicting one may also affect the other.

Just did a test edit in Chrome and get the same thing - message flashes up when opening the editor and when submitting.

But not the second time when I went back in to fix a typo - very puzzling! Only got warning on saving changes.

I thought this would be about prophylactics. I’m very disappointed.

From Fred's first post, it's apparent that the AV is flagging only the website not a specific document as malicious. Either the hostname or the IP address is getting flagged.

The backend system serving up attached files is likely shared across all of the sites hosted on the platform, so any malicious content that might land on it and result in the serving host getting flagged by an AV product could originate from any of the forums, not just this one.

Looking up the hostname files.homepagemodules.de in Virustotal [1], only one AV engine is marking it as malicious at the time of writing.. and it's not MalwareBytes. It's entirely possible that the hostname or IP address has been included as an IoC (indicator of compromise) at some point by MalwareBytes, but these change over time and what was flagged as malicious yesterday may not be marked as such today.

Re returning to fix a typo- it seems likely that the edit function does not permit you to add more files, so does not make any requests to the offending host or IP... ergo, no warning. (I'll test this in a minute when I try to edit this post..)

Edit: It does request something from that host in the edit function, but it's a file already in cache so no connection to the offending host is made. Ergo, no warning from AV.


[1] https://www.virustotal.com/gui/url/1cb38...34730/detection

Interesting.

I'm not an expert in this, so just speculation on my part, but yesterday when I put the IP address being flagged by Malwarebytes into the address bar of my browser it refused access but did give a message coming from "Varnish cache server" https://en.wikipedia.org/wiki/Varnish_(software). Today I just get a message from Malwarebytes warning me not to proceed to the address.

The IP address (136.243.249.66) being flagged by Malwarebytes therefore appears to be the cache server which I would think could be common to all websites running on infrastructure owned by the company hosting this website. I was therefore wondering if the variability in whether an alert comes up may depend on whether the requested page or file is in the cache or not, and this could vary over time as the data in question gets accessed. If it has been recently accessed by a user it will be in the cache and stay there for a while, and if it then doesn't get accessed for a period, it will be deleted by the cache server and next time it is requested will be accessed directly from the website again.

Maybe at some point some website supported by this cache server, not necessarily this one, could have had a Trojan uploaded to it, which once detected by an AV program or Malwarebytes may have been sufficient to get the address of the cache server blacklisted, in which case you would get the message when accessing any content from the cache server, but not if accessing it directly from the RS forum website. It would be irrelevant whether the content you accessed was the Trojan file, just accessing the cache server for any content would be enough to trigger the warning.

OK, I have just done a little experiment which seems to confirm my cache hit theory, with stuff in the cache triggering the warning.

If I go to the latest posts list, it seems like posts I have recently accessed trigger the Malwarebytes warning, presumably because their content is still in the cache server.

If I go to posts on page 5 of the list, i.e. stuff that has probably not been accessed by anyone for a long time, and is therefore not in the cache server, then I don't get the warning.

Of course, whether something is in the cache does not correspond with the date of latest update to a post, but to the latest time it was accessed which is a different thing, and which does not affect its order in the latest post list, nevertheless I think it is a reasonable assumption that posts in page 5 of the list are less likely to have been accessed lately.

Zitat von fred_jb im Beitrag #19

---

Interesting.
I'm not an expert in this, so just speculation on my part, but yesterday when I put the IP address being flagged by Malwarebytes into the address bar of my browser it refused access but did give a message coming from "Varnish cache server" https://en.wikipedia.org/wiki/Varnish_(software). Today I just get a message from Malwarebytes warning me not to proceed to the address.

---

Zitat von fred_jb im Beitrag #19

---

I was therefore wondering if the variability in whether an alert comes up may depend on whether the requested page or file is in the cache or not, and this could vary over time as the data in question gets accessed. If it has been recently accessed by a user it will be in the cache and stay there for a while, and if it then doesn't get accessed for a period, it will be deleted by the cache server and next time it is requested will be accessed directly from the website again.

---

Zitat von fred_jb im Beitrag #19

---

Maybe at some point some website supported by this cache server, not necessarily this one, could have had a Trojan uploaded to it, which once detected by an AV program or Malwarebytes may have been sufficient to get the address of the cache server blacklisted, in which case you would get the message when accessing any content from the cache server, but not if accessing it directly from the RS forum website. It would be irrelevant whether the content you accessed was the Trojan file, just accessing the cache server for any content would be enough to trigger the warning.

---

Zitat von wessie im Beitrag #21

---

this thread has appeared in the forum for the platform behind this website https://www.hpm-support.de/t544679f11769...d-Trojaner.html - in German but Chrome translates. The sysadmin have filed a false positive report to Malwarebytes as they cannot find any bad files in the reported IP address.

As stated in the thread, a number of AV/Malware suites are not flagging up a problem so it has to be a case of Malwarebytes being over-zealous, something they are well known for. Add the domain to your whitelist.

---

In case it is of any help to anybody trying to fix this, when I tried to access in a new browser tab the image address of a picture which was initially not displaying:

e.g: https://files.homepagemodules.de/b797706...n2_xBAyLiht.jpg

I got the following error message:

This site can’t provide a secure connection
files.homepagemodules.de sent an invalid response.
Try running Windows Network Diagnostics.
ERR_SSL_PROTOCOL_ERROR

The picture can now be accessed at the above address with no Malwarebtyes error.

It looks like this server is maybe having some sort of intermittent problem.

As of this evening, everything seems to have been resolved...at least on my PC.

Zitat von duccrazydave im Beitrag #25

---

As of this evening, everything seems to have been resolved...at least on my PC.

---

...It's back :-(

I took the address files.homepagemodules.de off my Malwarebytes allow list last night and it seemed OK. Opened this thread and several others today and still OK, then came back to this thread and at that point I got the Malwarebytes trojan warning, so it still looks like this must be something to do with a page getting cached.

Judging from the error message I got yesterday (The site cannot provide a secure connection, ERR_SSL_PROTOCOL_ERROR) the cache server is occasionally providing a bad response to the web browser, maybe at busier times of the day? It seems that Malwarebytes is detecting every instance where this happens, though I don't know why it interprets this as the presence of a trojan. It is therefore probably not a result of the entire site being blacklisted by Malwarebytes, otherwise the warning would appear all the time.

I would think the hosting company should be able to do something about this, as if the server is giving bad responses to browsers it is obviously not a problem at the client end.

Talking out my butt here, but another motorcycle site had an issue allowing me to submit/modify a post while on vacation. It turned out something in the new code saw something in my post as an attack when it wasn't. After an adjustment, it went away. I'll see if I can copy the post explaining it better....

Zitat

---

ME: I know the forum was down last night, but it seems copy and paste is buggered. Likewise, I get a “forbidden” page if content is longer than a few lines.

Board Moderator: First I've heard of this, and my monitoring systems didn't alert to any issues. I wasn't doing any work and haven't changed anything. What time? I'll test the copy and paste thing with an iOS device.

ME: Perhaps it’s where I’m at? I can’t access the forum over WiFi. I can access over cellular, even got the iPad to work for a while using the phone as a hotspot, but copy and paste has been wonky ever since updating to iOS 13. I’m wondering if something in the new iOS release doesn’t want to play nice with the board, but the iPad was not updated to 13.

I just tried on another web forum. Copy/paste works fine over there.

I’ve even redictated the entire post only to have the submission be blocked. My best guess is perhaps my local cellular provider puts a cap like Twitter, but why am I able to upload multiple photos to Flickr with no problem?

But now I get the other error...on the iPad...running 12.4.1. (403 Forbidden error)

Board Moderator: When I tried to paste your text back to you, it failed with a 403. Interesting. The copy/paste itself worked. Working on some tests.

Board Moderator: I found the issue that caused the 403. It was an over-active SQL UDF injection prevention script, which thought some of the SQL language used by the forum could also be used for a SQL injection. I simply removed that one rule. I don't know how/if this affects copy and paste. Let me know.

ME: In layman terms, what in the offending paragraph triggered the issue?

I don’t see how anything I wrote looks like code or was it buried in something other than the text itself?

Board Moderator: Sorry, I don't have a specific answer. Something in the formatting code triggered the same response as an attack would, under that one rule. You can't plan for all attacks, so some rules are over-reaching. Like your immune system responding to something inside your body and attacking you. AIDS. You gave the board AIDS.

---

Zitat von fred_jb im Beitrag #28

---

I took the address files.homepagemodules.de off my Malwarebytes allow list last night and it seemed OK. Opened this thread and several others today and still OK, then came back to this thread and at that point I got the Malwarebytes trojan warning, so it still looks like this must be something to do with a page getting cached.

Judging from the error message I got yesterday (The site cannot provide a secure connection, ERR_SSL_PROTOCOL_ERROR) the cache server is occasionally providing a bad response to the web browser, maybe at busier times of the day? It seems that Malwarebytes is detecting every instance where this happens, though I don't know why it interprets this as the presence of a trojan. It is therefore probably not a result of the entire site being blacklisted by Malwarebytes, otherwise the warning would appear all the time.

I would think the hosting company should be able to do something about this, as if the server is giving bad responses to browsers it is obviously not a problem at the client end.

---

Zitat von fred_jb im Beitrag #28

---

The site cannot provide a secure connection, ERR_SSL_PROTOCOL_ERROR

---