Malwarebytes blocking site

Hi folks,

Sorry for being so very absent but well... life.. work... excuses.

Anyway, just a quick heads up. Popped in briefly.. or tried to... and found that Malwarebytes is blocking the PrinterKnowledge site as a potential malware host indicating a Trojan. I've already run the site through TotalVirus and a few other malware scanners and they aren't providing any indicators that would back up the report so it's difficult to know what's causing the alert.

Thought I'd just let you know so those in the hosting side, and those googling the issue, can find this and see what needs to be done to detect and/or remove the issue or false positive.

...

Anyway, still very much alive, family growing, life chaotic but, on balance, good. Y'all take care of yourselves..

Martin

Did you receive a notification like this?



https://support.malwarebytes.com/hc...notification-from-Malwarebytes-for-Windows-v3

If so, could you screen capture it and post.

The only potentially sensitive info is "Port" as this might inform of an open port on your machine, though in this case the Port is for an outbound attempt to open and use that particular port, not necessarily an already open port. Regardless, you can blank it or cover it up in the image using Paint before posting if you want.

The above link explains what this warning is about and what to do about it.

I installed a trial version of MBAM Premium on a laptop and set the language to English. It blocks printerknowledge.com. Here is the pop-up notification:



I also made some screen shots from the MBAM program window. I can upload these if necessary.

@PeterBJ:

I wonder if the same warning occurs if you use a different internet browser such as Microsoft Edge, Chrome, etc?

First, our Union Jack friend websnail is on it with a query on the Malwarebyte forum.

https://forums.malwarebytes.com/topic/263834-printerknowledgecom-209182234131-trojan/


Second, websnail either has the worst luck for falling into error holes or he is great at finding them. (Glass half empty - half full.)

https://www.printerknowledge.com/threads/problem-notification-issues-and-emails.13665/


PrinterKnowledge.com IP address = 209.182.234.131

This IP address is out of Texas. Were the forum's servers always located in Texas?

IP address does not appear to be on any blacklists:

https://www.whatismyip.com/blacklist-check/

The laptop has got Edge and Firefox, no other browsers installed. Trying to access printerknowledge.com in Edge produces a pop-up with the same text

According to the MBAM forum it looks to me like this post and/or this post cause the problem. The service tool st4904 might be infected.

I tried to open the link to the service tool from the first of the two posts and got this warning from AVG:



The Danish text means: Threat secured. We have securely disconnected www.printerknowledge.com because it was infected with URL:Blacklist. There might be more hidden threats! SCAN MY PC.

So to me it looks like MBAM is right and does a good job. I think the best thing is to remove the st4904.zip links and explain they were deleted because of malware.

I still get the same pop up warning. There were two occurrences of the st4904.zip link. It looks like the st4904 in this post also needs to be removed.

The Hat said:

Try it now...

Click to expand...

I was able to download the service tool after you posted to "try it now".

PeterBJ said:

service tool st4904

Click to expand...

Yes, this file is flagged by both my installed Norton 360 and Malwarebytes free scan of the file saved on my hard drive.

May be a false positive but Malwarebytes obviously relies on a blacklist list to give such a fast response, ie Malwarebytes is not doing real time scanning when you just try to navigate to the home page of a website.

Unless there is something else triggering MB?