Internet Security App says Suspicious Application Found when I try to access posts

[JimmyJay]

Hello:

My eSet internet security app says the following when I try to access images in the forums:

" Threat found
This web page may contain dangerous content that can provide remote access to an infected device, leak sensitive data from the device or harm the targeted device.
Threat: JS/Packed.Agent.N suspicious application
Access to the web page has been blocked. Your computer is safe."

I haven't had this problem before yesterday. Does someone know what is going on? Others experiencing this? Thank you

[V]

You're likely accessing a thread with embedded images hosted on an image hosts that trigger that response. You'll have to provide one or more links to the pages where that message occurs for you.

[JimmyJay]

Thanks for your response. Here are a few links to the photo gallery where regardless of which image I click on, it gives me the Threat found response:
https://vipergirls.to/threads/915510...166-(10-05-23)
https://vipergirls.to/threads/913987...e-(02-10-2023)
https://vipergirls.to/threads/643721...ection/page205

As I say, I have used VG for some time and not experienced this until a few days ago. Any help would be appreciated. Thank you.

[LadyLuck]

I clicked on one picture in each link. No problems. I run MalwareBytes for anti-virus and uBlock Origin for ad blocking. Pale Moon web browser. All clear here.

[JimmyJay]

Thanks LadyLuck. I use eSet anti-virus. Must be something in the settings.

[Progishness]

Umm MalwareByte is not an anti-virus application, tho it is an excellent malware scanner.

I use Comodo Internet Security Premium for my real time internet protection and find it excellent.

[Lurkio]

Thanks for your response. Here are a few links to the photo gallery where regardless of which image I click on, it gives me the Threat found response:
https://vipergirls.to/threads/915510...166-(10-05-23)
https://vipergirls.to/threads/913987...e-(02-10-2023)
https://vipergirls.to/threads/643721...ection/page205

As I say, I have used VG for some time and not experienced this until a few days ago. Any help would be appreciated. Thank you.

It's almost certainly a false positive result in each case, most likely caused by fairly commonly used javascript code that in this case is used to inject third-party hosted advertising banners onto the imx website that is being detected by eSet as potentially malicious, but identifies the issue with a generic 'virus' name.

This kind of thing randomly happens all the time unfortunately, and isn't exclusive to image and file hosts. Indeed any site that uses similar javascript code that tries to call and/or embed data from a different site/URL onto the site/URL that you're actually trying to access can occasionally trigger a similar false positive response in just about any antivirus/internet security software system.

From memory there's an occasionally recurring conversation over in the IMX support thread on our helpdesk, where folks have randomly encountered this same issue (albeit with various different 'virus' names and security software) and the conclusion is pretty much the same as here - the detected problem is just an annoying false positive.

A quick search online also found this forum article about a variant of that 'virus' you mentioned from eSet's own customer forum.

[LadyLuck]

Umm MalwareByte is not an anti-virus application, tho it is an excellent malware scanner.

I use Comodo Internet Security Premium for my real time internet protection and find it excellent.

I kinda knew I shouldn't have typed that as soon as I pressed the send key. Glad you found something that works for you.

[Progishness]

No worries - I just didn't want anyone to be misled. I cannot recommend Comodo highly enough tho.

As well as MalwareBytes I find that SuperAntiSpyware is a more than decent malware scanner.

For stubborn infections tho try HitmanPro, ADW Cleaner or JRT (Junk Removal Tool).

[roger33]

Thanks LadyLuck. I use eSet anti-virus. Must be something in the settings.

Those antivirus softwares often use patterns to detect suspicious/malicious scripts. Yours look like a false positive. But clearing your browser cache and running an antivirus scan just in case won't hurt

There is a discussion thread on official ESET forums about another variant of that "JS/Packed.Agent". Some posts from the ESET staff:

It's just a detection of a specific JS obfuscation method. It's not detected as a threat but as a suspicious application.

No, there is nothing suspicious in your computer. You can see the detection described in screenshot, that you uploaded here: A suspicious application was found when Firefox tried to access a website.

Detected object was file "initialized.js" located on that website. Connection attempt was terminated by ESET, so nothing was downloaded.

Full discussion thread --> https://forum.eset.com/topic/33803-j...about-malware/

[Progishness]

I have updated my one stop shop for software recommendations to reflect the discussion in this thread.

[JimmyJay]

Thanks so much for this helpful information.