47

I noticed that Firefox has decided to block some EXE installers from my site, showing a label Blocked: May contain virus or spyware. I right-click the file, select Unblock, and this message is shown with the Unblock Anyway and Keep me Safe options:

The file contains a virus or other malware that will harm your computer. You can search for an alternate download source or continue anyway.

Notice that the dialog does not say may; it says will harm your computer.

On what basis is this warning being shown?

No one knows for sure which provider Chrome and Firefox are using for their extensive list of false positives. Some say that the site stopbadware.org is responsible, but I'm not so sure.

Please advise on how to proceed to restore what's left of my sites and software reputation in an immediately effective way, before it's too late. Thank you.

For those asking about the site and software, it's this: http://www.andreszsogon.com/grf-wizard/

The software is mine. It's a simple GUI for a command line tool; I developed it with VB6, compressed the app's EXE with UPX compressor, built the installer with Inno Setup, then uploaded it via FTP. I invite you to install it, test it and scan it all you want.

Improve this question
18
  • 35
    How do you know your exe doesn't contain a virus? Perhaps your computer has a virus that infected the compiler you are using and now the compiler inserts viruses into all exes that you try to compile? Alternatively, if your website is not using HTTPS, a man in the middle (e.g. your ISP) may be inserting a virus into your exe.
    – nullUser
    May 25, 2015 at 16:06
  • 7
    What is your site? Have you checked the EXE's on your site against VirusTotal or other sources? How do you know Firefox is wrong?
    – D.W.
    May 25, 2015 at 23:00
  • 4
    this online ativirus-test-suite say that your executable is infected: metascan-online.com/en/scanresult/file/…
    – Lesto
    May 26, 2015 at 1:02
  • 25
    Your question is very much a rant. This is not the appropriate place to vent your frustrations. The process of identifying malware is not deterministic; there will always be false positives and negatives. You do have a legitimate question, here, though; it's basically, "How does malware identification work and what can I do about a false positive?" We would all appreciate it if you could remove the personal, emotional content and get it down to a good presentation of the real question.
    – jpmc26
    May 26, 2015 at 6:09
  • 6
    You are running wordpress version 3.8.1 and claiming your site is secure? I would highly suggest some updates... you are far from secure.
    – Tim Hallman
    May 26, 2015 at 20:27

6 Answers 6

Reset to default
77

Before getting too caught up in your anger against Firefox and Google Safe Browsing, the first step is to figure out whether Google Safe Browsing is right. It's not uncommon for sites to distribute executables that contain malware or viruses, without realizing they're doing it. Often, Google Safe Browsing is right and the site maintainers just weren't aware of the situation -- sometimes their site was hacked, or sometimes someone uploaded some files that are virus-infected without realizing it.

So, start by taking a close look at your site to see if any of your downloads are possibly problematic. You can start by perusing the Webmaster Help from stopbadware.org and Google's Webmasters help for hacked sites. Then, there are a few general steps you should be taking:

  1. Check whether there's any malware on your site. You need to scan your site carefully to check whether any of the file downloads are dangerous or contain viruses/malware. You can start by using Google Webmaster Tools to check what bad files Google detected. You should also look at the detailed diagnostic page from Google Safe Browsing and look closely at the specific pages and files listed there. You can view the diagnostic page here to see which pages specifically triggered the listing. I also suggest that you upload each of the EXE's you make available on your site to VirusTotal and check them for viruses.

  2. Check whether your site has any security holes or has been hacked. Often, what happens is that hackers find a site that has some security holes, compromise the site, and modify it to insert malware onto the site. The first the site administrators learn of this is when they get listed on Google Safe Browsing. So, you should check carefully whether this has happened to you. Here are a few free services that will scan your website for you:

    If you find security weaknesses, take your site offline and fix them. If you find that your site has been compromised, it's likely that you'll need to wipe the site and reload everything from a known-good backup. See https://www.stopbadware.org/hacked-sites-resources for more resources.

  3. Protect your site against hacking. I suggest you review your site security and make sure it is well-protected against hacking, to prevent someone from breaking in and modifying it to serve malware. See, e.g., https://www.stopbadware.org/prevent-badware-basics for some background. Also make sure that your site software is fully updated.

When I use these tools, here is what I find:

  • Sucuri says you are running an outdated version of WordPress (pre-4.2). It looks like you are running Wordpress 3.8.1; 4.2.2 is the current version. This makes it likely that your site is vulnerable and can be compromised: there are multiple known vulnerabilities in Wordpress 3.8.1. You should make sure to always run up-to-date versions of software. When you fail to keep up-to-date, it creates an opportunity for attackers to compromise your site and use it to host malware. So, upgrade WordPress.

  • Google Safe Browsing says that your site was hosting malware when Google visited on 2015-05-10: "1 page(s) resulted in malicious software being downloaded and installed without user consent". Apparently no malware was found on the latest visit, 2015-05-25, so it sounds like at some point in the past, your site was hosting malware, but it isn't any longer.

    It's not clear what the problematic page was. The report for www.andreszsogon.com/grf-wizard says there were no malicious pages found under /grf-wizard. So, you can infer that the problematic page must have been some other page under www.andreszsogon.com -- but it wasn't anything under /grf-wizard. I tried playing around with Google Safe Browsing's online interface, but I wasn't able to narrow down which page caused your site to be listed in their system.

Improve this answer
7
  • 3
    All tests run, Webmaster Tools checked. Please remember I'm not just the regular average user who does not know how to install an AV or update it; I've been developing software and web apps for 15 years now. The site is secure, all software is CLEAN.
    – Andrew
    May 26, 2015 at 0:48
  • What kind of signatures /certs used self signed possibly? Also what compession is in play some compression types are more likely to be flagged as iffy
    – linuxdev2013
    May 26, 2015 at 2:24
  • 78
    @Andrew Honestly, if you would have the experience you claim you have you would know that a statement like "The site is secure" is totally impossible to make. E.g. : you're running wordpress, through the years there have been countless of zero-day exploits against wordpress installations. On top of that you also are running Google Adsense ads and seem to be using at least one third party Wordpress plugin. All considered you're probably fine, but declaring that you know that for a fact is just a sign that you don't know what you're talking about. Either way, (cont.)
    – David Mulder
    May 26, 2015 at 3:19
  • 21
    Google Safe browsing does sometimes give really odd false positives and in my experience they get fixed quite quickly as well, so good luck with this. All considered the Google Safe browsing project has saved me more trouble than it has cost me, but it can be quite irritating from time to time.
    – David Mulder
    May 26, 2015 at 3:23
  • 10
    @Andrew UPX is the packer most commonly used for packing malware, so if you also pack your downloads with UPX, you will set off alarms.
    – Michael Hampton
    May 26, 2015 at 21:35
33

Source Recently started to delete downloads claiming 'virus or spyware'.

"Last two days, some of the download have been started to be deleted by saying that 'Blocked: may contain virus or spyware' error message, at download window."

...

Firefox uses data from Google's "Safe Browsing" project to assess the reputation of websites and downloads. Every so often Google changes the data it supplies, for example, it may be flagging potentially unwanted programs in addition to actual malware.

For the future, the developers are considering an option to override the block and get the file anyway. It probably will be at least a few months before that appears because security-sensitive changes take time to design.

For now, if you think these file blocks are "false positives" and that the files actually are safe, you could do one of the following:

(1) Download the file using a different browser (yikes)

(2) Download the file using a downloader add-on that bypasses this security check. I heard about this in another thread but haven't tried it myself (and also, I don't know which add-ons to trust for this!).

(3) Disable the Safe Browsing feature temporarily to get the file, then turn it back on. There is a checkbox in the Options dialog:

"3-bar" menu button (or Tools menu) > Options > Advanced

On the Security tab, it's the "Block reported attack sites" checkbox. The other checkbox relates to phishing sites and I don't think it affects downloads.

Source How does built-in Phishing and Malware Protection work?

Firefox contains built-in Phishing and Malware Protection to help keep you safe online. These features will warn you when a page you visit has been reported as a Web Forgery of a legitimate site (sometimes called “phishing” pages) or as an Attack Site designed to harm your computer (otherwise known as malware). This feature also warns you if you download files that are detected as malware.

...

"I’ve confirmed that my site is safe, how do I get it removed from the lists?"

If you own a site that was attacked and you have since repaired it, or if you feel that your site was reported in error, you can request that it be removed from the lists. We encourage site owners to investigate any such report thoroughly, though; a site can often be turned into an attack site without any visible change.

  • To request removal from the list of reported phishing sites, use this form provided by Google.
  • To request removal from the list of reported malware sites, use this one, provided by stopbadware.org.
Improve this answer
6
  • 1
    Thanks, I'll try those forms. Please notice that disabling the filter, or using another browser (?) is not a solution, and I cannot force my users to use this or that browser because they are wrongly accusing my files which are perfectly clean. The only possible solution is that false positives are removed from the provider's database.
    – Andrew
    May 25, 2015 at 20:21
  • 7
    @Andrew, I also recommend you to send the files to virustotal. You will probably find out that some vendors are detecting your programs as malware (generic signatures, probably).
    – Ángel
    May 25, 2015 at 22:19
  • 19
    @Andrew It's unfortunate that not only have you submitted a rant, but also refuse to accept answers to the core question within it. The site is eventually a repository of knowledge for other users, not your personal help desk.
    – Sacho
    May 26, 2015 at 8:04
  • I found that GWT is showing this issue on a separate section called "Security issues", and the URL is labeled as "Undetermined malware". I re-uploaded the installer without using UPX for the main EXE, and kindly requested a review to get this issue fixed, thanks.
    – Andrew
    May 26, 2015 at 18:39
  • 2
    Andrew, if the installer passes the malware test with UPX removed, please remember to accept my answer.
    – Erik Knowles
    May 26, 2015 at 19:18
19

I've had to discontinue use of UPX with my own software because many virus scanners consider packer use to be de facto evidence of wrongdoing. You might try posting an unpacked version of your download and see if the warning goes away.

Improve this answer
6
  • 1
    is an answer? this is should be posted in comments.
    – Francisco Tapia
    May 26, 2015 at 18:21
  • 2
    In fact, Avast detects UPX.exe as a "threat". But the files compressed with it, are considered "clean". I have uploaded a new installer with the non-compressed EXE now, just in case.
    – Andrew
    May 26, 2015 at 18:36
  • 15
    Francisco: Why should I have posted this as a comment? It was clearly intended as an answer to the OP's question.
    – Erik Knowles
    May 26, 2015 at 18:48
  • 6
    @FranciscoTapia This is definitely an answer, and likely the right one.
    – Brad
    May 26, 2015 at 19:39
  • 1
    The good question here, though completely off-topic, is why to use UPX or any other EXE packer today, in 2015, with today download speeds? I can't hardly believe, that packing EXEs to reduce their size (if there isn't any more argument for doing so) could benefit anyone, especially taking into an account all tje troubles (expressed here in many points) that one might have when doing so.
    – trejder
    May 28, 2015 at 7:12
12

I did a view source on the page you linked, and well, that raises a question: Was it you that added the following script tag to your site? Or did someone manage to sneak that into your wordpress? 

<script type='text/javascript' src='http://www.andreszsogon.com/wp-content/themes/contango/lib/js/superfish/superfish-combine.min.js?ver=1.5.9'></script>

As I would rather strongly suspect that including anything from superfish would get you blocked by Google's Safe Search database. It nearly goes without saying that superfish has a very bad reputation. After all, look at what happened to Lenovo for including superfish software on their notebooks toward the end of last year. They took a HUGE PR hit.

Also, as AV software very often cannot/will not find many if any at all files containing malicious php. I would strongly advise manually (well with windows find or *nix grep whichever the case may be for the platform your site is running on) searching through your entire wordpress installation for files that don't belong and ESPECIALLY any files that contain php code that have eval() and/or base64_decode() in them, especially nested! If you find any that are not obviously part of the system and expected, then you should immediately start a new installation of wordpress and move your wp-content directory over into it, provided that there are not any bad files in there as well. In which case, you would be best off starting the site over from scratch. Fortunately that is pretty easy with a wordpress site.

Improve this answer
6
  • 15
    That could just be this Superfish jQuery plugin, which appears to be coincidentally named as such.
    – IMSoP
    May 26, 2015 at 9:27
  • 2
    Worth noting of course, that it could be as simple as the Superfish jQuery plugin is generating a false positive due to the name similarity to the other Superfish. If humans have a hard time differentiating them, not too surprising that a computer might also have difficulty.
    – aslum
    May 26, 2015 at 15:45
  • Thanks for the suggestion, as other users said, that script is a simple JS wrapper part of the Contango theme. Also, if the problem were on the WordPress installation, surely all files would be blocked, and not just one or two.
    – Andrew
    May 26, 2015 at 17:57
  • 2
    @Andrew Yes, absolutely, if it is actually part of the template/theme, then it is not the problem as it would be site-wide then. I suppose that perhaps, I should have had a gander around the site and looked to see if that was on all the pages. Often, in my experience when these sties get compromised, often weird things get injected into single pages. Clearly, I jumped the gun there. Mainly as I was not aware of the jQuery plugin that shares the name with that insidious software. I wondered if perhaps it was a rouge installer or something if you hadn't been the one to have added it.
    – Mce128
    May 26, 2015 at 22:27
  • 1
    Although, I do still strongly suggest checking for what I described in my last paragraph. Sadly, I see that kind of stuff very often when I get calls from clients who have wordpress sites that have been compromised. It is a rather common pattern within the files of the site. In fact, much of the time, I won't even find any system files that have been altered or only a small handful with anywhere from a few extraneous nasty files laying around to literally thousands! The file names in those cases are usually either trying to appear to be part of the system or they are generated gibberish names.
    – Mce128
    May 26, 2015 at 22:32
9

...compressed the app's EXE with UPX compressor...

~10 years ago, UPX was commonly used by viruses to make them more difficult to detect and reverse-engineer. In fact, it became so common that many anti-viruses now consider any UPX-packed program a threat by default. This is almost certainly your issue.

You really only have two options:

  • Use VirusTotal to determine which sites believe your software is malware, and submit your program to those companies as a false-positive.
  • Use a different method to compress your software. A good alternative is self-extracting executables, which should do an even better job at compressing your software, without the suspicious obfuscation.
Improve this answer
1
  • 1
    Thanks, that's very useful. Actually my AV detected the UPX compressor as a sort of "threat", which is very annoying. I will get rid of it from all subsequent versions.
    – andreszs
    May 28, 2015 at 14:55
4

I run a 20 year old software enthusiast website, and I also run into your issues. This is a site that had its heyday at around year 2000 and now functions as an archive. Around 3 times every year, Google Safe Browsing identifies a new piece of "malware", usually written and uploaded around 1999 to 2002. Never mind that its always been there. Never mind that nobody has touched it for over a decade. Scanning this file with virustotal inevitably shows that there is a virus, but it's never by the popular virus softwares like Symantec or others, always the ones you've never even heard of - once, one of its virus scanners even showed there is a virus on a 530 byte text file.

So what's the solution? Given that Google Safe Browsing is the judge, jury and executioner, you have 3 options:

  1. Delete the file and do something else with your life (recommended for sanity)

  2. Radically change the contents of the file (usually, if after changes virustotal doesn't pick it up, you're good to go)

  3. Put the file download behind a login

Personally, I wouldn't care for it much, I just find it sad when I have to delete a piece of software that can't really be found anywhere else.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.