Malware-bytes "hit" on the Trainz forums?

[maruffijd]

Last few days I have been getting a "hit" from Malware-Bytes.

When I click on some of the forum threads, the hit is "Blocked site domain 'members<dot>chello<dot>nl'" Is anyone else seeing this, or is it time for me to get out the a magnifying glass and lice comb? (It takes almost 2 days to scrub my machine's files and stuff. Yup, I'm that serious about my baby.)

The reason I ask here is it only is occurring when I open random Trainz forum threads and have not seen this anywhere else. If this belongs to any of the forum members, lemme know and I can go off of that.

 

[clam1952]

Probably a dodgy link in a signature or a dodgy picture hosting site, as doing a forum search it's listed in a lot of threads.

Got it, it's oknotsons signature banner, in Firefox right click view image info gives you the site the image is on.

Probably a false positive. Expect he will pick it up on here soon enough!

Edit: I've pm'd him.

 

[maruffijd]

I appreciate the heads up, as it seems to be a false hit, I will let it go untouched and carry on. I have confirmed it is oknotsen involved threads. No worries and this saves me 2 days of scrubbing my files.


@oknotsen, I apologize if this causes any headaches.

 

[oknotsen]

Thanks for the PM, Clam.

I have not changed my signature image for over 10 months or so, so I guess some software is going mental.
Though not the first time.
For the same / similar reasons my website can't be seen by some.

The image (and most of my screenshots) are hosted on the website that came with my ISP. Been the same for over 10 years, so I wonder what happened. Just arrived at my office, so can't really do much about it. I'll take down the image for a bit.

Could you tell me the name of the software and possibly post me a screenshot of the warning / message? I like to have something to slap into my ISP's face if they start asking questions.

Sorry for the inconvenience.
--- deliberately posted without signature ---

 

[Saieditor]

I have malwarebytes running, and I don't have any issues with oknotsen's posts - and I don't see any signature.

However, I also run an ad-blocker. in Firefox 48.0 beta 3 (has an occasional memory leak, on win64)

That could be the reason, and members dot chello dot nl must be listed in the adblockers or something?

 

[clam1952]

I think the pay for version of malwarebytes monitors browsers? free version doesn't as it has to be run manually, nothing here was picking up any problem

 

[maruffijd]

Indeed I did pay for the malware-bytes. Actually running the scan is clean with no hits, it only showed a blocked site warning on any thread that had oknotsen's posts.

Here's a pic of my screen with the malware warning in the lower right corner, (I had to actually type in the domain name to get MB to trip the warning, but, I got one.)

[/URL][/IMG] Hope this is what you needed.

 

[clam1952]

Checked IP on virustotal https://www.virustotal.com/en/ip-address/80.109.240.71/information/
Looks like there is a big problem with some nasty malware and quite a bit of it. Ransomware by all accounts.