diagnostic information requested about false positive website listing

Viruses and worms
1

Hi there , everybody. Hope you guys are all doing well.

I have recently experienced a problem with Avast listing my website as a dangerous URL.
It is actually a false positive, so I have requested de-listing.

Luckily for me, I use linux myself, and I don’t have Avast software.
So I found out i was listed thanks to my client, who advised me that his Avast anti-virus software has flagged my nice website as mistakenly being on the naughty list:

The message from the Avast web shield software is “Threat Secured. We’ve safely aborted connection on www.@@@@@.com becuase it was infected with URL:Blacklist”.

This message is very vague. I have googled to find out why this message is displayed, but no good answers were found.

Can anyone give me any support to diagnose in detail why Avast is showing this message regarding my website ?
Thanks in advance.

2

Well information is needed to do anything really, so obscuring the URL in the screenshot and not posting the domain name (without it being active, no http? etc. etc.) doesn’t help much.

Most of those on the forum are avast users and we also check the domain against a number of sites other than just avast.
These sites not only check for infection but security advice/weaknesses.

3

It was not an invitation to promote your store, but to allow people to investigate why it might be getting detected.

Hence the suggestion not to make the link live (as you have), just the domain name fabsurplus.com and there is no need for the additional promotion

We get lots of spammers on the forums and they are very quickly banned, so I suggest you modify the link and remove the unrequested promotion.

Finally there is currently no Avast alert on fabsurplus.com, which would indicate action was taken even if you haven’t had a direct response.

4

Dear David,

Thanks so much for your helpful and constructive comments about my 2nd post (Now deleted.).
I posted the diagnostic info and list removal info. as something to help the internet community deal with AVAST’s software when it has created a problem for a member of the internet community.

I have no idea about the way your forum works vis a vis posting live links although IMHO the web interface is certainly very dated and looks like it was written at least 20 years ago. Anyway 1000 apologies if I broke some rule or other with my feeble attempt at humour in my post.

The reason why my website is not blacklisted any more by AVASTs fantastic software is that I requested de-listing and, seeing as it was a false positive, it was thankfully de-listed.

So, internet dwellers, here is how to get de-listed if the folks at AVAST accidentally buckshot your website too. Enjoy !!!:-

I worked out what was going on with this message from Avast.

If you look around on the internet, you will find a series of “Blacklists”.
These are publicly maintained lists of websites/ IP addresses which have been reported as having malware on them , or being the source of phishing attacks etc.
Avast will block a website if it is on a blacklist (Not sure which blacklists are used by Avast ? It would be good to know which ones I have to check if I am listed by Avast.).

For example, one list which I believe may be used by Avast is www(dot)virustotal(dot)com.
You can check to see if a particular ip address is listed on this blacklist by going to the address www(dot)virustotal(dot)com/gui/ip-address/11.22.33.44
(Where 11.22.33.44 is the IP address in question that I just made up).

I believe that the AVAST error message including the text “URL:blacklist” generated by the Avast software is due to Avast has flagged that the website/Ip address in question is blacklisted.

So, if your website users are getting this message then, you need to do the following:-

  1. Check if your website is on any blacklists.
  2. If your website is on a blacklist, then, carefully follow the instructions on the blacklist website to remove the problem that was leading to your website being blacklisted. Typical steps when doing this will be to check your firewall, file permissions in the web directories, check any files identified for infection/viruses, check your mail server has not been hijacked and is sending spam etc. (Such spam problems can also be due to one of your e-mail users having a compromised mail password), check for malware and generally spend several hours/days making sure no security issues exist.
  3. Once you fixed any problem, then, submit your website IP via the blacklist website for de-listing.
  4. Avast also has a de-listing service for websites that have been put on the Avast blacklist.
    This de-listing service is at the following web address:-

www(dot)avast(dot)com/false-positive-file-form(dot)php

Note: be careful not to request de-listing if your website still has problems. Otherwise, you’ll just get blacklisted again.
5. Check back in a few hours/days to make sure you have been de-listed.
The service may send you an e-mail confirmation if you are lucky.
6. Repeat as necessary until the problem is solved.
7. Then, you can go back to your normal sysadmin status of “paranoid slumber” ha ha ha.

Thanks everyone for your kind attention, and I hope somebody finds this post useful.

So long, and thanks for all the fish…

5

You’re welcome.