Forum operation, design and help » Trojan Warning

Hi,

Just today I've started getting a Trojan warning from Malwarebytes every time I click on a post. It gives the domain as files.homepagemodules.de. Is this a false detection, so it would be safe to make an exclusion for it, or is it possible that you have an infection? See below for the report from Malwearebytes.

Thanks,

Fred

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 14/06/2020
Protection Event Time: 17:10
Log File: 91fbdd1e-ae59-11ea-aa96-bc5ff483ba03.json

-Software Information-
Version: 4.1.0.56
Components Version: 1.0.931
Update Package Version: 1.0.25472
Licence: Premium

-System Information-
OS: Windows 10 (Build 18362.900)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe, Blocked, -1, -1, 0.0.0

-Website Data-
Category: Trojan
Domain: files.homepagemodules.de
IP Address: 136.243.249.66
Port: 443
Type: Outbound
File: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe



(end)

I'm getting it as well.

I use Malwarebytes on my MacBook Air, which does a scan every few hours plus checking live. Having just run a scan I am showing clean.

I've ran Norton no issues.

It has stopped giving me the warnings now, and I haven't changed anything at my end.

The IP address reported as the source by Malwarebytes responds as "Varnish cache server" so I suppose it could be that the website's cache temporarily contained a file which Malwarebytes identified as a Trojan, whether rightly or wrongly. The relevant cache item may now have timed out and been discarded by the cache server. If so we will probably never discover what it was.

Oops - spoke too soon.

Got the Malwarebytes Trojan warning again when I clicked on this: Getting Older (3)

Maybe it only gives the warning when the page you access gets a cache hit and is served from there rather than the website itself, which might indicate that the website cache contains a malware file.

Same here. And when I tried to post a pic of the warning, looks like this:

On the joke thread, none of the attached cartoons are showing up, as well.

I don't believe it is necessarily a file in that specific thread. It may be that when you get a cache hit and the web page is served from the cache then Malwarebytes may see other files currently in the cache and be reacting to some completely unrelated file, though it seems a bit odd if it were to bother doing this as there could be many irrelevant files to check. If the actual webpage I am trying to open contained malicious code then Malwarebytes would not allow it to open, as I have seen that occasionally when following links from Google. However, that is not what happens in this case, the page still opens, but flashes up the warning.

I am going to try clearing all the caches in Chrome, even though the warning refers to an external source, and will also try the Edge browser instead.

Having cleared Chrome, I now get the warning as soon as I open the new posts page which is where I normally enter the website. In addition having deleted all my cached images in Chrome, they are not being refreshed from the website, so all images in posts, right down to the save quote, edit, quote, reply menu items and the like/dislike buttons are now missing their graphics.

It seems to be working normally in Edge and not triggering the Malwarebytes warnings.

Edit: the warning came up when I hit submit on this in Edge.

And again when I opened the editor again for this.