Urgent help needed: one of the top Croatian blogs blocked by McAfee as malicious

[ramya108]

I would like McAfee team to urgently review our webiste http://alternativa-za-vas.com

This is one of the top Croatian blogs in health category, with 40000 visitors per day.

Recently, our readers started complaining that they can not access our blog, and that it is marked as malicous by their antivirus software (McAfee).

I had to install McAfee on my PC in order to check this issue, and here we go: our blog is marked as red!! (the homepage is green, but all other pages are in red)

Interestingly, when I go to Site Advisor and to all other checks, our webiste is shown as trusted and totally free of any threats.

The issue is urgent, please resolve it ASAP.

Thank you.

[Peacekeeper]

It’s pretty straight-forward to get a false +ve site rating reviewed follow below and I will pindg a tech to see if he came expediate things due to your site's high visitor rate.. 

However, here are the steps:

1. Browse to www.trustedsource.org/en/feedback/url
2. Recommended for website owners or anyone else who wants to be updated on the request status:  Create an Account and then Login
3. Click on “Check Single URL” (since most re-evaluation requests would be for a single URL)
4. Select the Product you are using – in our case choose “McAfee SiteAdvisor”
5. Type in the URL you want to check
6. Click “Check URL”
7. Optional:  Choose up to 3 categories from the drop-down “Optional categorization suggestion:”
8. Optional:  Leave an “Optional comment”
9. Click “Submit URL for Review”

10)  If you created an Account (and logged in with it), a Ticket ID will be displayed, along with 3 options on when you will receive email (when the ticket isOpen, Reviewed, or Closed)

[ramya108]

Thank you. I submitted a ticket to trustedsource.org.

Lets hope they act quickly on that.

[dougk_t3]

It's working for me using SiteAdvisor client version 3.6.4.176. Perhaps TrustedSource has already addressed the issue.

If the problem still exists for your users, I'd suggest checking their client version - versions 3.5.x and below use a different mechanism.  Note that the auto-upgrade mechanism is silent and requires a reboot for the new version to be fully implmented.  If they still have an older version after reboot, they can download the latest from siteadvisor.com.

Meanwhile, SiteAdvisor doesn't actually block access to a page.  It does throw up a redirect page (in English this page is identifiable with a red message with a big "Whoa") that simply warns the customer.  They can click past that warning by selecting "Visit anyway".

[Hayton]

This site is Safe - or is it?

Message was edited by: Hayton on 29/01/14 22:05:13 GMT

[Peacekeeper]

Not working 3.6.5.131 Sa version the home page ok but the links down the page are red

[ramya108]

Yes, Peacekeeper is correct.

Only the homepage is green, everything else is red. I just would like to know why. If there is any suspcious or outdated script, please can someone let me know about it?

[Hayton]

Correct. I was modifying my earlier post and then got diverted into a study of PHP, which is perhaps the culprit here.

First, though, this site is running under a version of Apache which is a year old.

Running on: Apache/2.2.24
System info: (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.6 

The latest version in 2.2.x is 2.2.26, but Apache is urging users to upgrade to 2.4 (latest version there is 2.4.7).

http://www.apache.org/dist/httpd/Announcement2.2.txt

The Apache Software Foundation and the Apache HTTP Server Project are pleased to announce the release of version 2.2.26 of the Apache HTTP Server ("Apache").  This version of Apache is principally a bug fix maintenance release.

We consider the Apache HTTP Server 2.4 release to be the best version of Apache available, and encourage users of 2.2 and all prior versions to upgrade.  This 2.2 maintenance release is offered for those unable to upgrade at this time.  For further details, see:

http://www.apache.org/dist/httpd/Announcement2.4.txt

The Red rating is apparently on all pages that include "index.php" in the URL, so it seems likely that something is configured wrongly. Exactly what, I don't know. Wikipedia (normally quite helpful) doesn't have much to say about this.

http://en.wikipedia.org/wiki/Webserver_directory_index

However, these two pages might throw some light on the matter -

http://www.php.net/manual/en/security.apache.php

http://ellislab.com/expressionengine/user-guide/urls/remove_index.php.html

[ramya108]

Hayton,

Thank you very much for your advice, I will do my best to fix both index.php and Apache issues.

Meanwile, my ticket was reviewed and our blog re-listed under health and blog categorijes.