Solved Malwarebytes warning from Vivaldi connection.

maher13

Every time I go to the password page vivaldi:password-manager/passwords, I get a warning from Malwarebytes that the browser is infected.

I tried many methods.. but I did not succeed.. I tried resetting the settings to default and logging out, logging in to another account, removing extensions... I did not succeed.
Is there a way to remove the infection from the browser

Modedit: title

Pathduck

@maher13 This happens only for the vivaldi://password-manager/passwords page?

I think it's quite simple. It's certainly not an "infection" of Vivaldi.

When you open the Chromium passwords page, it will try to get favicons from each of the sites you have stored passwords for.

So, either you have stored a password for nimoultv.com or the site shares an IP address that has or is marked by MWB as malicous.

So I suggest you go through your list of stored passwords.
My bet is the site is in there, or a site that shares the same IP, possibly the site was infected at some point.
Currently the site seems to be a video production agency, but it might share IP with a malicious site.

OrbitalMartian

@maher13 I have no knowledge or experience of any infection in Vivaldi, though I don’t recognise the URL you mentioned.

Try accessing Password Manager via Settings > Privacy > Passwords, see what that gives you.

mib2berlin

@maher13
Hi, the shown IP address is from EIG Network Operations, connected with bluehost.com and endurance.com.
https://www.reviewhell.com/blog/endurance-international-group-eig-hosting/

Does this ring a bell for you?
Open vivaldi://serviceworker-internals and check if something relevant is registered as service worker, unregister it.

maher13

@mib2berlin
It doesn't really ring any bells for me. I've looked it up and can't figure out what's so weird about these services. Is it safe to remove them all?

mib2berlin

@maher13
Yes, open Help > About and look for the path to your profile folder "Default", close Vivaldi.
Open this folder and delete the folder "Service Worker".
After the next start of Vivaldi it create the folder and restore the three default service workers.

maher13

@mib2berlin
I already did that before I wrote this post.

mib2berlin

@maher13
And do you get still the Malwarebytes warning?
Very strange.
We need another Malwarebytes user.

maher13

@mib2berlin
Yes, it is still poping up

mib2berlin

@maher13
Hm, if you downloaded Vivaldi from vivaldi.com you can be sure it is not infected, we had many false positives over the time.
Maybe you change the title to Malwarebytes reported Infected Vivaldi or something to get more users to check the thread.

Pathduck

@maher13 This happens only for the vivaldi://password-manager/passwords page?

I think it's quite simple. It's certainly not an "infection" of Vivaldi.

When you open the Chromium passwords page, it will try to get favicons from each of the sites you have stored passwords for.

So, either you have stored a password for nimoultv.com or the site shares an IP address that has or is marked by MWB as malicous.

So I suggest you go through your list of stored passwords.
My bet is the site is in there, or a site that shares the same IP, possibly the site was infected at some point.
Currently the site seems to be a video production agency, but it might share IP with a malicious site.

maher13

@mib2berlin
I will try to download Vivaldi from vivaldi.com.
I could not change the post's title .. It is not allowed.
feel free to change it if you can

maher13

@Pathduck
Yes only for password page
I'll check it

maher13

@Pathduck
you nailed it !
I have this site in my 300 passwords thank you for your help!

Pathduck

@maher13 Maybe a little cleanup is needed?

mib2berlin

I never noticed the favicons in the list.

Pathduck

@mib2berlin Yeah, I thought it might do that so did a little network capture while opening the passwords page. Turns out it makes a connection to each site in the list, to get the favicon (presumably...)

I don't know why it just doesn't use the Favicons cache for this, some Chromium stupidity I can only assume

iqaluit

I have been having the same warning but not only with vivaldi, with some other trustworthy software as well. It is a Malwarebytes thing. Just white list them and it disappears.