Malicious Apache module removed; request to re-assess two IPs

Viruses and worms
1

Howdy,

[Deleted at my manager’s request]

Jonathan L.

2

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for: * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Undetected Malware; Press (Media), issues.

  • If you are reporting an FP, then you get another input field open, enter the web URL for the site you wish to submit for review (Network Shield), etc. A link to this topic also wouldn’t hurt, but since you have edited the information isn’t available.

You say it is for a couple of IPs, presumably these IP addresses host more than one domain ?
The network shield may have an IP block rather than a domain block if there are multiple domains on the IP that were infected.

3

Hello David,

Thanks for taking the time to share tips with me. I’ve submitted a False Positive report to that form before, but will submit another one. Also, I suspect that one server is IP-blocked while the other only has some (many?) URLs blocked. I need to do more research, and this will certainly make for an interesting report submission.

I’m hoping it’s ok to submit multiple URLs in one report submission. If you know otherwise, please let me know.

Regards,

Jonathan L.

4

Reports submitted.

Research indicated that one IP was IP-blocked while the other had specific sites blocked.

Jonathan L.

5

You’re welcome.

Obviously when reporting an IP block, just use one of the domains and in the report ask for a Network Shield review in relation to it being an IP block, you could possibly list the other domains effected (for that IP) in the remarks of the report.

6

Thanks David,

I actually put the IP in for “Website” and then explained it further in the “Message” section. Do you think that will invalidate my report?

Jonathan L.

7

I don’t think so (but I’m an avast user not employee), I would have though if IPs weren’t allowed it would be rejected at the input phase of the report.

8

Thanks David,

That’s what I figured too. We’ll find out eventually, I expect.

Jonathan L.

9

No problem.

Hopefully it will be resolved soon.

Some sites that we (users/volunteers on the forums) use to check out sites when we have a domain name.

http://sitecheck.sucuri.net/scanner/
http://urlquery.net/
http://www.urlvoid.com/

Some of these will also give information on other sites on the same IP address that may be infected, which could result in an IP block rather than a domain name block in the Network Shield. Whilst the network shield doesn’t use these resources for its malicious sites list.

10

Update: Got a response today from an Avast! engineer. All sites reported yesterday through the online form have been unblocked (Oh, happy day!).

So, for those of you who are experiencing this: Go to the on-line contact form at:

http://www.avast.com/contact-form.php

…fill it out, then be patient.

Regards,

Jonathan L.

11

Yes, they are usually quite prompt in resolving these when confirmed.