cancel
Showing results for 
Search instead for 
Did you mean: 

Malware Warning on my Plusnet Space

Badders
Dabbler
Posts: 13
Registered: 02-07-2010

Malware Warning on my Plusnet Space

Hi,
I am getting a Malware warning on my webspace (which I have completely emptied aside from the linked image below) as follows:

It is reported as URL:MAL and references blog.eurekajewelrydesign.com, as site I've never seen or heard of before now.
This is triggered in both AVG and Avast through Google Chrome and Firefox, but NOT IE8.
I am puzzled as it even came up when there were absolutely NO files uploaded.
Has anyone else seen this?
Thanks,
Pete.
27 REPLIES
danger11
Grafter
Posts: 110
Registered: 23-02-2010

Re: Malware Warning on my Plusnet Space

Hi Pete
I think the reason is blog.eurekajewelrydesign.com may be a malicious website And is linking to your site. If you pay for your webspace @ plusnet i would contact customer support on 01142965198 Immediately.
Good luck Smiley
VileReynard
Seasoned Pro
Posts: 10,863
Thanks: 252
Fixes: 10
Registered: 01-09-2007

Re: Malware Warning on my Plusnet Space

Have you looked at http://www.badrick.plus.com/ - it's virtually empty.

danger11
Grafter
Posts: 110
Registered: 23-02-2010

Re: Malware Warning on my Plusnet Space

Yeh i noticed that also..
However i have again tried to access it and avg popped up.

Results
Danger: AVG Active Surf-Shield has detected active threats on this page and has blocked access for your protection.
The page you are trying to access has been identified as a known exploit, phishing, or social engineering web site and therefore has been blocked for your safety. Without protection, such as that in the AVG Security Toolbar and AVG, your computer is at risk of being compromised, corrupted or having your identity stolen. Please follow one of the suggestions below to continue.
URL: blog.eurekajewelrydesign.com/main.php?h=www.badrick.plus.com&i=J8mtjdIVqP6liRj+XsRCzJEZ&e=4
Name: Rogue Scanner (type 1144)
pierre_pierre
Grafter
Posts: 19,757
Registered: 30-07-2007

Re: Malware Warning on my Plusnet Space

the contents of your site are
[DIR] Parent Directory        27-Jun-2005 09:22      - 
[IMG] glitch.jpg              02-Jul-2010 22:28    25k 
[IMG] warning.jpg            02-Jul-2010 22:28    26k 
Avast didnt like it either
I have been getting a lot of spam emails recently that have modified redirects to genuine URL's just like your one, I think that they are all to do with a Facebook address list that I can trace back to an ex friend - the list is several years old and the URL's are also on French and German Facebook
VileReynard
Seasoned Pro
Posts: 10,863
Thanks: 252
Fixes: 10
Registered: 01-09-2007

Re: Malware Warning on my Plusnet Space

Are you sure that it's not being marked as a "bad" web site, simply because it doesn't have an index.html file in it?

danger11
Grafter
Posts: 110
Registered: 23-02-2010

Re: Malware Warning on my Plusnet Space


Quote from: A
simply because it doesn't have an index.html file in it?

No, mirror sites (CentOS,Apache etc) do not have a Index. Just because the files are not visable, does not meen they are not there.

Badders
Dabbler
Posts: 13
Registered: 02-07-2010

Re: Malware Warning on my Plusnet Space

Quote from: pierre_pierre
the contents of your site are
[DIR] Parent Directory        27-Jun-2005 09:22      - 
[IMG] glitch.jpg              02-Jul-2010 22:28    25k 
[IMG] warning.jpg             02-Jul-2010 22:28    26k 
Avast didnt like it either
I have been getting a lot of spam emails recently that have modified redirects to genuine URL's just like your one, I think that they are all to do with a Facebook address list that I can trace back to an ex friend - the list is several years old and the URL's are also on French and German Facebook

I do have a Facebook account, but there is no reference to my plusnet spare on there. My sign in is a gmail account. I've raised a ticket on this issue and they told me it is my local machine, which clearly isn't the case.
Pete
danger11
Grafter
Posts: 110
Registered: 23-02-2010

Re: Malware Warning on my Plusnet Space

They blamed it on your machine? lol they realy dont have a clue do they...... If that was the case it would be just you who had the virus popup thing.  Come on plusnet!!!! stop blaiming your customers all the time!!
Community Veteran
Posts: 3,789
Registered: 08-06-2007

Re: Malware Warning on my Plusnet Space

It seems that the various 'malware' scanners are picking up on your partial URL being passed as an argument to another URL.  IMO, this is a false positive from the malware scanners, and not an actual threat.  (the site containing malware seems to be the jewellery site you linked earlier)
B.
Plusnet Alumni (retired) orbrey
Plusnet Alumni (retired)
Posts: 10,540
Registered: 18-07-2007

Re: Malware Warning on my Plusnet Space

It's nothing to do with the webspace, I've just visited it from my home machine (with avast! installed, same as OP). There were no warnings.
I also tried the link with the eurekajewelrydesign URL in there and it didn't load - that may be that it was a dodgy site (and the cause of the errors) and is now down, but I also use the mvps hosts file mod so it could be that too.
I suspect that the cause of this is either malware on the OPs PC redirecting any queries via a dodgy site, or possibly as Barry says a false positive due to the link.
Where did you end up with the blog.eurekajewelrydesign link?
Badders
Dabbler
Posts: 13
Registered: 02-07-2010

Re: Malware Warning on my Plusnet Space

It can't be malware on my machine, otherwise nobody else would be getting the warning. Which browser did you use to check it? IE8 doesn't trigger it, but Chrome & Firefox both do.
Also AVG reports the problem as well as Avast.
I have contacted the domain provider for eureka from the whois information, but am yet to have any reply.
I hope someone puts their hands up very soon as I have removed my Son's site from Plusnet space as lots of people were complaining about it to him. Another indication that it isn't MY machine.
Pete.
Superuser
Superuser
Posts: 2,818
Thanks: 530
Fixes: 5
Registered: 06-04-2007

Re: Malware Warning on my Plusnet Space

I don't get it with Firefox or IE8 if I go to http://www.badrick.plus.com/, but if I stick index.htm on the end I get redirected to blog.eurekajewelrydesign.com/main.php?h=www.badrick.plus.com&i=J8mtjdIVqP6liRj+XsRCzJEZ&e=4.  Do you have a dodgy .htaccess file in there that is doing the redirect?
Phil
Community Veteran
Posts: 4,854
Thanks: 121
Fixes: 24
Registered: 14-07-2009

Re: Malware Warning on my Plusnet Space

Kaspersky does not perceive any threat. 
Community Gaffer
Community Gaffer
Posts: 17,650
Thanks: 642
Fixes: 162
Registered: 05-04-2007

Re: Malware Warning on my Plusnet Space

Quote
Do you have a dodgy .htaccess file in there that is doing the redirect?

Bingo, just removing it from the webspace now.
If this post resolved your issue please click the 'This fixed my problem' button
 Chris Parr
 Plusnet Staff