Sounds you have Intermedia software on your computer.

See:

• https://www.google.com/search?sa=N&num=100&q=intermedia%20%22live%20scan%22
• https://kb.intermedia.net/Article/47928

hi... thanks for your reply. I do not have intermedia software on my computer??? this just started to show up one day. i spoke with them and they seem to think i have it installed, which i don't. they are no help, of course.

i did a registry search, nada, pc search, nada. i did find some intermedia files but they were mainly teXt, no apps, no eXe's (sorry keyboard got wet and some keys are toast)... no audit trail for any kind of software anywhere

any ideas on how to find this malware?

much appreiciated, sir!! :-)

Hi ernman111, is this an issue with links from your email, or does it happen on other kinds of sites, too? Email sites sometimes modify links to run through some kind of security service, so that's why I asked about that.

greets, sir... interestingly, it tends to only happen when i go to certain sites and only on the first visit. below are a couple of addresses of interest. the first url seems normal and there is no intermedia splash screens. the second on always has it. most of this is gibberish but the important parts are the first few words after https..

the second url is of interest it appears whatever site i go to has this as the default: https://url.emailprotection.link. then comes the intermedia scan. then it proceeds to the site. if you go to the link, you get the image attached.

warmest

Ernest

https://eur01.safelinks.protection.outlook.com /?url=https%3A%2F%2Femail.lyftmail.com%2Fc%2FeJyNjr1uhDAQhJ_GdKDdtY3twgXJHY-Q9rT-y6FgcjpQSN4-UKWNNNJoivn0Jc8uYW7mn7Ldal5Xfs-3KXkqCmXS1FKRqVUuqNYVVVrNgWJgK53hZvIEBGABQZIj6rCD8bU34CQMRquX4SoUnOjK09zFz9rcfUDLqseQiYozkaNk3TuwhATaBtXM_r5tj1XIQdB4ZN_37mSc_2PGeYofRz_4uzXwpd-EHP_Ehbz8S_3p83OpvCDioVjX5aT_AuZGTms&data=02%7C01%7C%7C8250b9c0a7e54596444e08d835cb161d%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637318493644102824&sdata=DHF8EGKytsWZOG9vMfUe0ZAtZiZNO3%2BzrAWzoBk%2BjVI%3D&reserved=0

https://url.emailprotection.link/?bJnvr9VqSrDCTiDLLyJgqJKNTrhfZunvOUpAmE5NQdtkagWwulkMxG_0NJ_nrA5ZX1JRwQr4CfRlug4vwdA8d5BoX11Fk4_1O52gZMqtVYh1WnGe_mXmhoUZbN45aIHMO

Hi ernman111, the first link looks like a pretty standard Microsoft filtering link. The second, hmm, I don't know where that is coming from. The sender?

agree on the first one... i wud say yes but it shows up on every link i click on in my outlook. just not all links display the redirect splash screen...no matter how many times i click on the same link in my email, it occurs. yet it is somewhat sporadic across a variety of embedded links. however the link always shows the email protection verbiage, regardless.

i have scrubbed my system looking for some clue. i am thinking to reinstall outlook... i will send microsoft a note, but i used to work with them as a consultant so i know how they work if you are not a big macher with them... :-)

'preciate the conve and ur input...

cheers,

Ernest

Hi Ernest, if this is work email, I would check with your IT on whether they changed something.

If this is personal email:

Are you accessing your mail directly on Microsoft's servers (e.g., outlook.office.com or outlook.live.com)?

If not, Intermedia is the largest Exchange hosting provider, so possibly your email service provider has been using them on the back end and recently changed your configuration??

My outlook is both personal and using an exchange for one of my clients where i have an email address. it doesn't matter which email account i use, the results are the same. i may try to contact intermedia again once their servers are back up (they might have been attacked or hacked).

so... as many electric condoms as i have on my equipment, somehow, something got through...grrrr...:-)

thanks for ur help...much appreciated!! Ernest Worthman, Senior Member IEEE Executive Editor, Applied Wireless Technology Staff Editor, AGL eDigest Editor, IEEE Mile High Spark Newsletter Guest Lecturer, Colorado State University and University of Denver College of Engineering Vice-Chair, Denver IEEE ComSoc Chapter Advisor, Telecommunications Industry Association (TIA) Standards Development Committee Member IEEE Vehicular Technology Society Member IEEE Communications Society Member IEEE MTT Society Member IEEE 5G Community eworthman@aglmediagroup.com www.aglmediagroup.com/applied-wireless-technology www.aglmediagroup.com ernest_worthman@ieee.org 303 290 9700

You can check the connection settings.

• Options/Preferences -> General -> Network: Connection -> Settings

If you do not need to use a proxy to connect to internet then try to select "No Proxy" if "Use the system proxy settings" or one of the others do not work properly.

See "Firefox connection settings":

• https://support.mozilla.org/en-US/kb/firefox-cant-load-websites-other-browsers-can

I wonder if there's a rogue extension installed. Can you check via Menu Button -> Add-ons -> Extensions

Hi Andrew...thanks for ur reply... that was my first thought but there is nothing new in that section... :-)

This appears to be a result of Intermedia LinkSafe™. https://kb.intermedia.net/Article/47928##LiveScanning

Do you have LinkSafe in your programs via control panel?