# PS Audio site throwing up MBAM riskware block today on many pages **URL:** \ **Category:** Forums\ **Created:** [July 16, 2020, 5:08pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012 "2020-07-16T17:08:32Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 16, 2020, 5:08pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/1 "2020-07-16T17:08:32Z")
In case others are seeing it, today, at a number of pages on the site Malwarebytes is throwing up a “riskware” potential threat block for a domain called jquerylab.pw (95.179.178.92). MBAM is not blocking any site pages, but apparently something else that sounds like a marketing info tracker. I’ve emailed Paul and reported it to MBAM. Follow up: Paul replied: “It’s apparently happening to a lot of Wordpress based sites. Nothing there. We just did a safety scan.” ---
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 17, 2020, 5:28pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/2 "2020-07-17T17:28:34Z")
It’s still going on 24 hours later. ---
**Author:** ![Elk](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/elk/32/1240_2.png) [@Elk](https://forum.psaudio.com/u/Elk)\ **Post date:** [July 17, 2020, 7:15pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/3 "2020-07-17T19:15:55Z")
I have not received any alerts accessing the site on multiple machines, and not oddities in the site itself. ---
**Author:** ![CJ\_720](https://avatars.discourse-cdn.com/v4/letter/c/6de8d8/32.png) [@CJ\_720](https://forum.psaudio.com/u/CJ_720)\ **Post date:** [July 17, 2020, 7:34pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/4 "2020-07-17T19:34:14Z")
My eset antivirus keeps prompting me that it is blocking this potential risk as well. ---
**Author:** ![owlsalum](https://avatars.discourse-cdn.com/v4/letter/o/e47c2d/32.png) [@owlsalum](https://forum.psaudio.com/u/owlsalum)\ **Post date:** [July 17, 2020, 7:39pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/5 "2020-07-17T19:39:04Z")
Have never received warnings of any kind navigating the PSA site. I use McAfee on my windows laptop. ---
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 17, 2020, 8:15pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/6 "2020-07-17T20:15:34Z")
Well, something is going on if two anti-malware programs are responding the same way. MBAM support said he called PS Audio, but I don’t know who or what came of it. ---
**Author:** ![aangen](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/aangen/32/295709_2.png) [@aangen](https://forum.psaudio.com/u/aangen)\ **Post date:** [July 17, 2020, 8:18pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/7 "2020-07-17T20:18:35Z")
Not seeing it at all here. Odd. (using Malwarebytes Premium 4.1.2) ---
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 17, 2020, 8:29pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/8 "2020-07-17T20:29:44Z")
Elk, what anti-malware programs do those machines have? I’m writing MBAM again and letting them know the status of things. ---
**Author:** ![Elk](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/elk/32/1240_2.png) [@Elk](https://forum.psaudio.com/u/Elk)\ **Post date:** [July 17, 2020, 8:52pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/9 "2020-07-17T20:52:29Z")
Avast and Kaspersky Clearly something is going on. ---
**Author:** ![Paul](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/paul/32/6_2.png) [@Paul](https://forum.psaudio.com/u/Paul)\ **Post date:** [July 17, 2020, 9:53pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/10 "2020-07-17T21:53:52Z")
There is no risk. The site is clean. That’s a problem with Wordpress on many sites. ---
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 17, 2020, 10:01pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/11 "2020-07-17T22:01:25Z")
I didn’t think there is a risk, just endless pop ups. It’s your site and your sub with Wordpress. What are they saying? Gene ---
**Author:** ![Elk](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/elk/32/1240_2.png) [@Elk](https://forum.psaudio.com/u/Elk)\ **Post date:** [July 17, 2020, 10:28pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/12 "2020-07-17T22:28:00Z")
This would be annoying. Can you whitelist the site to avoid the warnings? ---
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 17, 2020, 10:53pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/13 "2020-07-17T22:53:04Z")
Not a bad idea for now, but for some reason MBAM is not recognizing the exception, even with the specific page address. Not been a good luck couple of days with the website. Today, I tried to download the Grusin file, but the server doesn’t like IDM and sees it as trying to do two downloads, so I get none. I wonder if there’s something about the server’s programming that is causing it, because it is not usual, but for practical purposes IDM is trying to figure it out. ---
**Author:** ![frankhertz](https://avatars.discourse-cdn.com/v4/letter/f/c89c15/32.png) [@frankhertz](https://forum.psaudio.com/u/frankhertz)\ **Post date:** [July 18, 2020, 11:37am UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/14 "2020-07-18T11:37:22Z")
I get messages from my Norton antivirus, as I visit pages on your site, stating that it has blocked “Form Jacking Website 73”. This just started in the past couple of days. Harry ---
**Author:** ![Paul](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/paul/32/6_2.png) [@Paul](https://forum.psaudio.com/u/Paul)\ **Post date:** [July 18, 2020, 12:02pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/15 "2020-07-18T12:02:10Z")
Yes, there is no malware on the site but there is a bug in Wordpress that triggers the malware identification programs. It’s not just us, it’s all sites running on Wordpress. ---
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 18, 2020, 6:07pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/16 "2020-07-18T18:07:09Z")
According to someone I checked with, PS Audio’s site uses Cloudfare. What is the relationship between their software and WordPress? ---
**Author:** ![Paul](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/paul/32/6_2.png) [@Paul](https://forum.psaudio.com/u/Paul)\ **Post date:** [July 18, 2020, 6:42pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/17 "2020-07-18T18:42:32Z")
Cloudflare kind of “hosts” our site with cache’d versions around the country for quicker access. The server itself is on Amazon web hosting. ---
**Author:** ![highstream](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@highstream](https://forum.psaudio.com/u/highstream)\ **Post date:** [July 18, 2020, 7:00pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/18 "2020-07-18T19:00:40Z")
Ok, then where does WordPress fit in? Btw, I’ve posted the problem specifics on their forum, with a disclaimer that it’s posted there based on what I’ve been told. ---
**Author:** ![Paul](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/paul/32/6_2.png) [@Paul](https://forum.psaudio.com/u/Paul)\ **Post date:** [July 18, 2020, 8:42pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/19 "2020-07-18T20:42:02Z")
The site is written on Wordpress ---
**Author:** ![Paul](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.psaudio.com/paul/32/6_2.png) [@Paul](https://forum.psaudio.com/u/Paul)\ **Post date:** [July 24, 2020, 12:17pm UTC](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012/20 "2020-07-24T12:17:55Z")
As a follow up to this problem here’s what our webmaster forwarded to me. Last Thursday and Friday two customers reported that their virus software identified trojan malware on our site (Trojan Crycos 4109) - this was a false positive. The antivirus was identifying a file within WordPress itself as harmful and we were not infected with this malware. Earlier this week, we started receiving complaints for a different malware (JS/Spy.Banker.FX), and that turned out to be legitimate. This morning I was able to identify and remove it. There was never any danger to our visitors. Thanks to everyone who chimed in and helped identify a small problem that we were able to fix. [Next page](https://forum.psaudio.com/t/ps-audio-site-throwing-up-mbam-riskware-block-today-on-many-pages/18012.md?page=2)