3

I operate a file hosting site, and recently I've found that some antivirus software have flagged it as malicious due to a few nasty files people have uploaded.

Obviously I don't want my site to be flagged as malicious, as at the moment people are complaining that their AVs are completely blocking my site.

I've set a robots.txt file to block crawlers from the /file/ directory, and I've sent an email to ESET (the vendor of one particular antivirus that's flagged my site.

I've also implemented a VirusTotal check on upload of any .exe, .dll or .com files.

What further steps should I follow to get my site removed from any AV blacklists that it is currently on?

Edit: I've contacted ESET and they'll be removing my site from their blacklist. My question still stands, but from more of a mitigation perspective.

Improve this question

4 Answers 4

Reset to default
3

What I would suggest you do is Google around, see what sites are reporting yours as malicious. For example, I found that this post on Free PC Security is where most of the reports come from. Try contacting that site and asking them why your whole domain is flagged, and request that they remove you from their list.

Also you could check out websites like Web of Trust or SiteAdvisor (links go directly to the report on AnyHub) to see why your site is flagged and if you can rectify this situation. Most of these sites give you help on how to get your reputation up and some even let you post a comment as a site owner explaining what happened.

Improve this answer
2

The first question I would ask is what is your site hosting? And is ESET flagging just that file or your entire site?

And then I would say not to worry about it really. Unless Google blacklists your site, your in the clear. That said, if a desktop AV flags your site as malicious, how long until/if Google does?

Improve this answer
1
  • The entire domain is blocked. As I said to Farseeker, I have no issues with individual files being blocked - in fact I do remove malicious files when they're reported.
    – anonymous coward
    Oct 25, 2010 at 5:56
1

If, by your own admission, your users are uploading nasty files, then the anti-virus programs are doing their job and are will within their rights to block your site from their users computers, and I don't know if there's any way really around this.

Improve this answer
2
  • I have no problem if antivirus software blocks the individual files, but I would like to know how I can have the domain itself not flagged. Surely there's a way, as sites such as Rapid Share and Mega Upload aren't blocked on a domain basis.
    – anonymous coward
    Oct 25, 2010 at 5:54
  • @Charlie - in that case I would hazard a guess that the AV people don't know your site is an upload site, and have just assumed that because a few reports came back of virus's originating from the site they just automatically blanket-banned it.
    – Mark Henderson
    Oct 25, 2010 at 6:43
0

I've also implemented a VirusTotal check on upload of any .exe, .dll or .com files.

And what if I rename my virus.exe to cutekittens.jpg? You need to scan every file regardless of filename.

But once you have that in place I would suggest that you are pretty safe. Obviously the core problem is hosting malicious files. Anti-Virus applications are well within their right to block the entire site if a user is able to download a virus.

Improve this answer
6
  • If you change the extension of an executable it is no longer executable, rendering it harmless. It's impossible to scan them all since VirusTotal's API is rate limited.
    – Arda Xi
    Oct 26, 2010 at 14:27
  • @Arda: I don't think that is true, but regardless it's certainly possible that a virus could be made to activate when the file is read by Windows or opened with a particular program. Furthermore, only checking .exe doesn't solve the original problem, because external virus scanners would still pick up cutekittens.jpg as a virus, even if you are correct and it doesn't pose a threat to users.
    – DisgruntledGoat
    Oct 26, 2010 at 16:50
  • @DisgruntledGoat - How would an executable that has the wrong extension be executed? Can't be executed at all without renaming it. Also, regarding AV, they will not. They will pick it up if it is a virus that exploits a vulnerability in Windows like you described, but such a virus would be harmless (and not picked up) if it was renamed to an exe. Besides, why would someone upload a harmless virus?
    – Arda Xi
    Oct 26, 2010 at 17:03
  • There are some exploits that apply to non-executable files (eg JavaScript in GIFs or JPGs), so I definitely wouldn't discount those kinds of files. If it's feasible, why not just run all files through a test like that?
    – John Mueller
    Oct 27, 2010 at 20:44
  • On Linux, file types are determined by reading the file headers so if you rename a .gif to .jpg it knows that it's a GIF image. I don't think that happens on Windows currently but that doesn't stop it happening in the future. Nor does it stop a user figuring out that the file is meant to be an exe and renaming it. Oh, and don't forget to check .zip, .rar and every compression format under the Sun. The point is whatever the filename, if it's a virus it's potentially dangerous.
    – DisgruntledGoat
    Oct 28, 2010 at 12:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.