Malwarebytes Warning About Trojan

I'm sure it's just Malwarebytes being over sensitive but i's happening in every group I'm a member in.
Thank You for any suggestions.
https://crittersandmore.forumotion.com/
https://bratzandfriendz.forumotion.com/
https://escapefromreality.forumotion.co.uk/
https://taggerscafe.forumotion.com/
https://nuttersinn.forumotion.com/
https://help.forumotion.com/

Does it happen when you try to load the forums or while you are on them?

The issue is that the images are uploaded on 2img.net
Those forums have many images they must use our hosting service

It was doing it after I got on the sites.  It's not doing it now on any of them.  So I guess the problem was fixed. Sorry I bothered y'all.
Thank You

I thought it was solved but it's still doing it as I look at some other posts. Strange huh?
So it has to do with the image hosting service 2img.net?

i was thinking that probably your antivirus is blocking that site
for me all sites are uploading fine with Kaspersky

try open the sites with another browser

another problem might be your browser extensions try to disable them and retry

as you can see the banner is upload with 2img.net

Hello, I hope it's ok to reply, I thought it better to use the same thread than create a new one on the same topic since this one is active.

I have the same problem; Malwarebytes flagging for "trojans" and blocking "2img.net". It started happening a few days ago, and hasn't been a problem before. It happens on all forumotion sites I've checked (as well as swedishforum, the swedish branch of forumotion). Malwarebytes reacts the same on this support forum as well.

I'm unsure as to where the "2img.net" thing comes from; most of the images on my own forum are uploaded either via servimg.com, discord, or directly to the forum from users computers when i.e uploading avatars. Does forumotion use 2img.net when uploading avatar images directly from your own computer? And if so, is it possible to change that?

I'm using firefox.


(same message as OPs, but in swedish)

can you post your forum url please

if this is your forum here it is you have uploaded your banner with 2img.net image

https://numoori.swedishforum.net/

it's on the swedish branch of forumotion, so everything's the same other than the "swedishforum" url. Using the free package, phpBB2.

thank you check my above post
reload your banner with servimg and retry to check if your issue persists

i did some tests seems and i think you are right @Kreftropod
somehow images are re-upload automatically with 2img.net even if we have uploaded them with servimg
so i will open a ticket about this
Since it is Sunday and our head office is closed we will wait 1,2 days and when i have news i will get back to you

@Joanie

than you

Uploaded it with servimg, and am still getting the same message. Tried to change the url for the background as well, since it showed the same 2img url. The original image urls used (servimg and discord alike) doesn't have 2img.net in them, so it seem to be something added once they're viewed on the site. Example with the background:

Url used for the background: https://cdn.discordapp.com/attachments/625617669323882498/712254339665625178/Rain_BG_2.png (has no 2img.net in it)
When viewed on site turns into:


I inspected the site code to see if I could find 2img.net anywhere else, and it seem to hide at the bottom of this javascript(?) part. I'm not super good at coding and such, so I'm unsure if there's any way I could change this?


Edit: Saw your reply. Thanks for the help! Hopefully it won't be anything difficult to solve

Hello again. I went to the Malwarebytes Help Site & here is what they said.

The block has been added because of the malicious file being hosted -
2img.net/h/www.atlantis.malware-site.www/upload/1467219127_favicon.ico

I just saw your message skouliki & thank you.

general speaking

2img . net is used to rehost 2 types of images
those which are not hosted on servimg and those posted in forum messages whose link is not secure starting with http

Hello, I am an assistant mgr at one of the forums Joanie is posting about.
https://nuttersinn.forumotion.com/forum

Here is a message from another one of our members there:

Another member received the same message and reached out to Malwarebytes Tech Forum Support. The image is this one:

Good Morning Y"all

I'm the one who sent that issue to Malwarebytes Tech Forum Support. The image at that location (in sparkle's post) has been marked as malicious. Because of this every image in Nutters is now broken when I go to the forum with Malwarebytes running, regardless of browser used.

Thank you for all the information

I just went back through all the groups & at this time I am no longer seeing that warning. Maybe it's fixed?
Thanks

A favicon is what is in the browser tab.

@SLGray

Thank You that explains why the warnings were showing up in all the groups.

the ticket is marked in progress the techs are trying to find a solution as soon as possible

Hello,

Are you still reproducing problems with Malwarebytes ?

If it is the case, could you please post the screenshots of the messages you are obtaining ? Thank you in advance.

@Luzz

Howdy,
The warnings I was getting is in the head post.
As I said in a previous post, on August 23rd, I am no longer seeing the warnings. I haven't for 2 days.
I don't know about anyone else, they've not made any comments lately.
Thanks

Hello Joanie,

Yes, great - Sorry, I did not got the situation

So, good, seems to be solved, as the Support team of Malwarebytes tells us they don't find the detection no more.

@Luzz
Thank You dear. I guess this can be marked as solved. I'll do that now.