Problem accessing remote NAS server. URL:mal threat detected

system · 2017-11-08T15:48:49.000Z

I am using the free version of Avast antivirus. I am running into a problem when trying to access a remote Drobo NAS server. Avast blocks access to the server saying that it is infected with URL:mal. I can only access the server if I turn off the web shield component of Avast antivirus. I have tried adding the address of the server to the URL exclusion list of the web shield, but it makes no difference.

I don’t understand why URL:Mal suggests that it is a blacklisted server - it is a personal Drobo NAS; nor do I understand why whitelisting it as an exclusion in the Web Shield does not allow access.

Can anybody please advise how I can get access without having to always turn off the web shield component?
Many thanks.

Pondus · 2017-11-08T15:51:35.000Z

Post screenshot of avast message

see below the box you write in: Attachments and other options

system · 2017-11-08T16:14:35.000Z

Error message attached.

Pondus · 2017-11-08T16:16:46.000Z

Blacklisted and not just avast
https://www.virustotal.com/#/url/66dbbbe7547837252a53cf09d055ac6d9e1684ec3cf8d8904740b5fd479a30ed/detection

IP History >> https://www.virustotal.com/#/ip-address/50.116.41.25

system · 2017-11-08T16:20:22.000Z

Thanks for your quick response.

I really don’t know why it is blacklisted. It is only my son’s Drobo connected to his local ISP provider (Xfinity) in Boston.

Pondus · 2017-11-08T16:23:36.000Z

Have reported post to avast, they may reply here and it can take hours before they do

Also see how to report if you want to
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

system · 2017-11-08T16:26:20.000Z

Many thanks for your help. Much appreciated.

HonzaZ · 2017-11-08T16:34:52.000Z

This URL was blocked because of distributing BlackHole EK, we have spotted these URLs in the near past:


50.116.41[.]25/Cal.jar
50.116.41[.]25/Edu.jar
50.116.41[.]25/Klot.jar
50.116.41[.]25/data/Qai.jar
50.116.41[.]25/data/ap2.php
50.116.41[.]25/data/score.swf
50.116.41[.]25/getJavaInfo.jar
50.116.41[.]25/page.php?p=88fe38de
50.116.41[.]25/s.php?f=07768
50.116.41[.]25/s.php?f=07768&
50.116.41[.]25/s.php?f=07768&e=4

Are you sure the server hasn’t been infected?

system · 2017-11-08T16:38:03.000Z

It is my son’s Drobo. He bought it 2nd hand some months ago and has only set it up. I’ve asked him to check.

Pondus · 2017-11-08T16:40:09.000Z

In case you wonder what it is
BlackHole EK = Exploit kit = https://en.wikipedia.org/wiki/Blackhole_exploit_kit

system · 2017-11-08T17:10:51.000Z

Does anybody know how to scan the OS on a Drobo NAS for malware?
Neither I nor my son can find anything on the web. Yes the files loaded onto the Drobo can be scanned but unsure how to check the OS that the Drobo uses.

Announcements