Malvertising Reported by Malwarebytes
-
Both in Snapshot & Stable versions I'm getting a block running Malwarebytes Premium. The file it is identifying as problematic is Application > (Snapshot) Vivaldi.exe.
I just downloaded the most current stable version of Vivaldi to its own folder & I am getting the same popup.
Can anyone offer me any suggestions? Does anyone else use Malwarebytes who is getting the same problem? Is it even possible that the malvertising snuck into the Vivaldi servers after it went down & was fixed a few days ago? TIA
Jan Rifkinson
Ridgefield CTVivaldi 7.4.3671.3 (Official Build) (64-bit)
Revision 3a863f57b5de5c97834577463e4586fc8c9a0b37
OS Windows 11 Version 24H2 (Build 26200.5518) -
@janrif Perhaps a extension which wants to fetch ad data connects to this IP.
-
@janrif said in Malvertising Reported by Malwarebytes:
Is it even possible that the malvertising snuck into the Vivaldi servers after it went down & was fixed a few days ago?
No, Vivaldi servers were not affected by malware or other security issues, so the Vivaldi binary can not have been hijacked or infected.
Vivaldi installer and exe file is signed by a certificate and that can be checked.I guess some "free" software on your PC could have installed such malware.
-
@janrif It's not reporting
vivaldi.exeas malware. It's reporting an outbound connection from Vivaldi to the IP in question.This connection could be initiated by an extension for instance, or simply from visiting a website that in turn makes a request for a resource on that IP.
Would be interesting to know when you get this warning, what website you're visiting when it happens, how often etc.
Listing all domains hosted on an IP is difficult, but there are tools out there that can do it.
https://2ip.io/domain-list-by-ip/139.45.197.154/
That's a lot of shady-looking domains... -
Some report on this IP at
https://www.virustotal.com/gui/ip-address/139.45.197.154/detailsLoosk like website behind this IP send ads and othr unwanted things.
Oh strange domains behind this IP:
https://urlscan.io/search/#139.45.197.154 -
@janrif Probably some bad site snatched into the browser data. Purge the whole cache and check the service workers:
vivaldi://serviceworker-internals
