FPs ? (Web Shield)

abruptum · 2017-01-05T20:51:10.000Z

No warnings this morning, but now :

http://imgur.com/a/0g3MC

http://imgur.com/a/LsD7p

https://www.virustotal.com/en/url/f0fb106994dc4796d05b951e227969db2f6edf351f4da271e24a8c318c4eb0a8/analysis/1483648987/

https://www.virustotal.com/en/url/fc8541ef10707b76c046c07aac964a49295c87735ec652bd226086baf952fac1/analysis/1483649030/

Maybe bad streaming update ?

Eddy · 2017-01-05T20:56:27.000Z

More likely a malicious site.

VirusTotal does NOT scan sites.

DavidR · 2017-01-05T22:14:05.000Z

The Web Shield almost from its inception has had a very high degree of accuracy. That can be seen from the many topics in the viruses and worms sub-forum, with many site owners professing their site is clean only to find that it wasn’t. That said it isn’t impossible for an FP, just that they aren’t frequent.

Given the name of the site, uploading.site I wouldn’t be too surprised if there weren’t malware examples contained within.

abruptum · 2017-01-05T22:56:36.000Z

DavidR post:3:

Given the name of the site, uploading.site I wouldn’t be too surprised if there weren’t malware examples contained within.

I am using Uploadrocket and Uploading every day. The name doesn’t mean anything.
If it is not a FP, then it is probably malvertising or something.

DavidR · 2017-01-05T23:23:32.000Z

The domain name of the site could well have a bearing on what is contained, who is to say malware isn’t uploaded. That could result in avast alerting on the site.

However the malware name, JS:Downloader-CWT [Trj] would seem strange when you are actually uploading.

Eddy · 2017-01-05T23:28:01.000Z

The name doesn't mean anything.

Although the name by itself doesn't indicate it is a malicious domain, it sure should raise all alarm bells as most domains with names like that are malcious/spreading malware.

UploadRocket.net - Easy way to share your files

Get the huge clue. Anyone can upload everything to it and share it. That means including malware.

Why are you uploading to that site ?
What are you uploading to that site ?

Given the name of the site, uploading.site I wouldn't be too surprised if there weren't malware examples contained within.

DavidR, don't be surprised. There are tons of malicious software to be found there ;)

If someone wants to share e.g. family pictures, movies taking on their holidays and other normal things. there are much better/safer ways to do so other then placing them on the “web”.

savcin · 2017-01-06T11:48:56.000Z

In source code I can see typical obfuscation commonly used by locky downloader scripts. I recommend you to use other “safer” type of obfuscation.

abruptum · 2017-01-06T11:59:50.000Z

savcin post:7:

In source code I can see typical obfuscation commonly used by locky downloader scripts. I recommend you to use other “safer” type of obfuscation.

I don’t understand. Those are not my sites, I’m only a user.

Eddy · 2017-01-06T12:01:31.000Z

Stay away from such sites.

abruptum · 2017-01-09T20:59:26.000Z

It is fixed. No more warnings on Uploadrocket and Uploading.
Uploading.site is fully functional after I blocked 1st party scripts in uBlock Origin.
With 1st party scripts enabled, only way to use the site was to disable adblocker and that is not a smart move.

Announcements