My site marked malicious ... for hosting TeamViewer program ??

[jayce68]

Hello,

I installed McAfee Saas on the computer of my customer, I wanted to download TeamViewer QuickSupport program (renamed distance.exe) on my site, and after three warning McAfee, full access to the site clicway.fr is totally blocked (malware).

I contacted McAfee several times and no answer form, please urgent problem.

My site is analyzed:
- Securi: nothing (except McAfee)
- AVG: nothing
- VirusTotal: nothing (except BitDefender ... same problem??)

Thank you in advance

[Peacekeeper]

I assume you asked for a review (option on popup warning) as site owner. This does not get an immediate reply though their guidelines says reply in 24hrs they as busy so this may take longer.

Post the site URL as 1 of the mods here is good at analysing site issues and might look at the site if he has time.

[jayce68]

Thank you Peacekeeper.

It must be more than 5 days since I made ​​the request, why I ask here.

The URL is www.clicway.fr.

Thank you in advance

[Peacekeeper]

Will ask hayton to look into the site hopefully you get a reply soon.

[Hayton]

It is a problem detected by TrustedSource, which has changed the SiteAdvisor rating to Red.

TrustedSource says the site is Malicious, but I can find no problem with the site itself except for two blocks of Unicode embedded in one of the javascript files (according to urlquery). In the Chrome console I do not see this code, perhaps because it is in one of the scripts which have been blocked by AdBlock or Abine. The Unicode looks like this : I cannot say if it is suspicious or not. It appears to be associated with entering an email address somewhere.

The only other problem I can see is the file "distance.exe" which is the TeamViewer QuickSupport program. Where did you get this from, and when? I see that it can be downloaded from Softonic, Softpedia, CNET and Majorgeeks (and many other places) but the only safe place to get it is from the TeamViewer site at http://www.teamviewer.com/en/download/windows.aspx. I scanned the downloaded file with Malwarebytes and McAfee and neither reported a problem; I uploaded the file to VirusTotal and it was passed as Clean by all the anti-virus scanners.

However, the Properties dialog of "distance.exe" does not show any version number for the program, and the digital certificate is invalid. The encryption is weak RSA 1024-bit, the To-date has expired, and the certificate is self-signed by Teamviewer. This means the program is an old version, and could potentially be fraudulent.

The certificate for the current version (8.0.22298) of TeamViewer QuickSupport should look like this - it uses RSA 2048-bit encryption and is counter-signed by Symantec Time Stamping Services.

This may not be the reason why TrustedSource finds a problem with your site, but it can easily be rectified.

One other possibility is because your site is on a server at 213.152.15.73 with other websites which are blacklisted. One example is mihaela.fr - see

http://sitecheck.sucuri.net/results/mihaela.fr

http://urlquery.net/report.php?id=6342357

http://sitecheck.sucuri.net/results/alaping.fr

http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=alaping.fr

There is a list of suspect websites on the server (not up to date) at

http://www.urlvoid.com/ip/213.152.15.73

http://www.urlvoid.com/scan/clicway.fr/

Nevertheless the IP address does not appear to be blacklisted.

Symantec Time Stamping Services

[jayce68]

Hello Hayton and thank you for your help.

Actually, you're right it is an old version of TeamViewer QuickSupport, so I replaced by the latest (but kept the name distance.exe useful for our IT operations).

On the two blocks of code, I can not find it? (Firefox, Chrome, Safari, IE10). I think it should be Contactable Jquery. Can you give me js file's name ?

Other malicious sites on the same IP does not belong to me, it is a shared host (not a dedicated server). I can do nothing for it but I think it's not the problem.

I think the problem should be the version of TeamViewer, because I had good access to the site, and after 3/4 attempts (download blocked by McAfee Advisor and Saas), I no longer had any access to the site.

Is it possible to restart an analysis of the site, now that I've updated the file?

Thank you in advance

[Hayton · Accepted solution]

The Unicode in a javascript file : I could not see this in the page source code but urlquery has an extensive section of Javascript Evaluations, and I saw it there. The code has sections for email address and credit card details, so I do not think this is inserted code from one my Chrome add-ons. Some of the embedded strings are in German, which I thought was strange.

http://urlquery.net/report.php?id=6397087

        },
        messages: {
            required: "This field is required.",
            remote: "Please fix this field.",
            email: "Please enter a valid email address.",
            url: "Please enter a valid URL.",
            date: "Please enter a valid date.",
            dateISO: "Please enter a valid date (ISO).",
            dateDE: "Bitte geben Sie ein gýýltiges Datum ein.",
            number: "Please enter a valid number.",
            numberDE: "Bitte geben Sie eine Nummer ein.",
            digits: "Please enter only digits",
            creditcard: "Please enter a valid credit card number.",
            equalTo: "Please enter the same value again.",
            accept: "Please enter a value with a valid extension.",
            maxlength: $.validator.format("Please enter no more than {0} characters."),
            minlength: $.validator.format("Please enter at least {0} characters."),
            rangelength: $.validator.format("Please enter a value between {0} and {1} characters long."),
            range: $.validator.format("Please enter a value between {0} and {1}."),
            max: $.validator.format("Please enter a value less than or equal to {0}."),
            min: $.validator.format("Please enter a value greater than or equal to {0}.")
        },

As the site owner you can get your site re-tested and re-rated by going to the SiteAdvisor site page and clicking the Request A Review button.

If nothing happens after a few days, email TrustedSource directly and get a ticket number.

If you want to address an issue with a web site in Site Advisor, that is based on McAfee's Trusted Source Web Reputation, please go tohttp://www.trustedsource.org/en/feedback/url and use the web form to contact the Trusted Source team.
If you want to track your requests or be notified via email, you can register for a free TrustedSource.org account.

[jayce68]

I was afraid when I saw credit card in this code, but after investigation, simply, it's the Jquery's script Validation.

I checked directly on the official website and compared with my file, no problem (same code).

I still think it was just the TeamViewer program, because Site Advisor denied to access to the site after several attempts to download this program (before was OK).

I'll ask them to retest, I will return to this forum to give news.

Thank you again Hayton for your help.

[Hayton]

My pleasure.

I agree that it's probably the Teamviewer file that caused the problem, but I'm at a loss to know what exactly it is about the file that triggered the warning. All I can think of is that the combination of an expired certificate and the certificate being self-signed caused it - I know that's sometimes seen in malware. I wasn't aware that there was a check for that specific combination. If it's not that, the other possible reasons aren't serious enough to trigger the site alert.

Good luck with the re-test request, they're running very slow right now.

[jayce68]

I just give news.

After sending a ticket, and after analysis, my site now appears OK, problem solved.

It was the old TeamViewer QuickSupport the "faulty".

Thank you again!

Ce message a été modifié par: jayce68 on 14/10/13 09:20:08 CDT