Dangerous pages attempt to install software...

[glennts]

For several weeks Bitdefender has been blocking attempts by NinjaTrader 7 to connect to >>http://rainbow-in.com/connect/check-in.php<< which it recognizes an an infected web resource. What is this all about?

[bltdavid]

What you're seeing has nothing to do with the NinjaTrader folks.

Do you have the "Rainbow" indicator on any of your charts?

Remove it from all your charts and those access attempts will stop.
If that doesn't fix it, uninstall it by removing the assembly.

I believe the Rainbow indicator(s) are no longer supported (or even
available) from the original author.

That website belonged to the original author of the Rainbow indicators,
and apparently is no longer maintained by him.

Unfortunately, most of the Rainbow indicators were distributed as
closed source, so there's not much anyone can do about the issue
you're seeing.

[bltdavid]

If you know how to update the configuration of your Windows firewall software, you can
instruct it to ignore attempts to connect to that website.

[glennts]

Thank you for the reply. Yes I have had Rainbow installed on trade execution charts for several years. This new behavior obviously speaks to your mention of new actors getting involved. There may have been an unused routine that they were able to unlock and that suggests access to the source code, which then raises the question of how was this "calling home" feature triggered on my install after years of being dormant. Although Rainbow has features I find useful I'll remove it rather than give these mystery people whatever is it they are looking for.