Avast blocking my site without telling me why (SOLVED)

[Cool Javelin]

Hello to all I am a new to this forum.

I am using Avast 7.0.1426 and XP SP2.

I have a site called www. terradancer. com and when I attempt to access it, I get the "Malicious URL blocked" popup from Avast.

My wife, using Avast 6.0.1407, does not have this issue.

I get Avast may have an issue with this site, but the real problem is Avast_does_not_tell_me_WHY_it_blocked_the_site !!

When I click on the "More Info" link, it brings me to an Avast page telling me how great Avast is, "Look we saved your computer" but doesn't tell me WHAT is wrong with the site so I can fix it.

How can I get some kind of report from avast to give me details about this problem so I can fix it?

If my customers are blocked with false alarms I am loosing money.

Thanks, Mark.

[Gargamel360]

Well, you are probably blacklisted, rightly or wrongly.   

Could you post the site address but break the link (change http to hXXp)? 

edit: nvm, I need glasses 

edit 2; What address is the pop-up showing?  Is it a different address than your site?  As in, is it blocking your whole site, or just linked content?   Are your virus definitions on the PC that is alerting up-to-date? 

[Pondus]

scroll down to domain check
http://www.urlvoid.com/scan/terradancer.com/


Zulu URL Risk Analyzer - report    http://zulu.zscaler.com/submission/show/36d143b211816a8720cf4f9240c92365-1333565725

IP address has been identified as risky by one/more sources
Risk associated with country location of server: CA (Canada)

urlQuery - Suspicious
http://urlquery.net/report.php?id=38208

[polonus]

Hi Pondus,

If we have a look for the IP, we can establish that it had unknown_html_google_malware and mdl_fake AV malware of which malware the response is dead or closed. There is a higher than average probability that the user will be exposed to malicious links or payloads, as BrightCloud rep index is yellow 40.
Malware could have come via this link: http://www.google.com/safebrowsing/diagnostic?site=home.comcast.net
Because the AS seems to go scot-free: http://sitevet.com/db/asn/AS32491 "as a dog with remoresefull eyes" 

polonus

[!Donovan]

My wife, using Avast 6.0.1407, does not have this issue.

Why is your wife still using avast! 6? Avast! 7 is way better in many ways.

I get Avast may have an issue with this site, but the real problem is Avast_does_not_tell_me_WHY_it_blocked_the_site !!

When I click on the "More Info" link, it brings me to an Avast page telling me how great Avast is, "Look we saved your computer" but doesn't tell me WHAT is wrong with the site so I can fix it.

Avast! does give you some information. When_Avast_alerts_URL:MAL_that_means_that_the_site_is_blacklisted.
If_there_was_a_serious_threat_avast_would_alert_the_problem_such_as_JS:REDIRECT_or_SCRIPT:INF.


As the others have mentioned..,
It appears that your site is being blocked because of it's nature with the same IP as other malicious sites.

See: http://www.urlvoid.com/ip/64.99.64.32/ (note: there are two pages)
Your site is the only whitelisted site with that IP.

The others host or used to host unknown HTML google malware.


You can report a false positive here: http://www.avast.com/contact-form.php?loadStyles.

[Cool Javelin]

OK, Wow. Thanks for all the prompt help.

Well, this has opened a bunch of worms for me. I have several sites hosted on my Comcast storage pages, all of which are giving trouble.

------
Gargamel360:
The address in the popup window is indeed the same as I expect. This is true for all my sites with this issue.
Further, reading some other posts, I check other sites I have hosted and the all have issues with Avast, but my actual sites are safe.
------
Pondus
Thank you for these links. I see MY site is OK, but others on the same IP address have issues.
-----
polonus
If I read you correctly, you are saying there was malware in the past?

!Donovan

Avast! does give you some information. When_Avast_alerts_URL:MAL_that_means_that_the_site_is_blacklisted.

That may be, but it would be nice if it actually said that in the popup or the the site it brought up via the link.

You can report a false positive here: http://www.avast.com/contact-form.php?loadStyles.

So, let me get this straight.

When I try to go to any site, Avast first calls home and asks if it is OK, then if not, pops up a message?

So, Avast is totally keeping track of my browsing history?
-----

[Gargamel360]

It does not "call home" first....the blacklist is updated with the virus database.  Although that might change for certain cases now with the hybrid cloud database that it also uses.

Avast! has a server infrastructure to maintain, with tens of millions of users.  Maintaining a database of all users total browsing history would require more than they would want to handle.  They are not Google, who as a search engine primarily, benefits from wide-scale anonymous tracking...they are an anti-virus.  So they do keep data....but just data regarding infections, infected domains, IPs.   Things that help them, thus by proxy helping you and all its users.

[Cool Javelin]

Update:

Gargamel360:

I went back and updated my virus database and low and behold, at least 2 of my 5 sites seem OK now. I guess you were right.

Now, if I could retract the emails I sent to Avast asking them to fix an issue that has already been fixed I could stop the crow eating. (MMmm magpie stew.)

Thanks for everyone's help. I will keep those links they are good tools.
Mark.

[Gargamel360]

Update:  Gargamel360:   I went back and updated my virus database and low and behold, at least 2 of my 5 sites seem OK now. I guess you were right.    Now, if I could retract the emails I sent to Avast asking them to fix an issue that has already been fixed I could stop the crow eating. (MMmm magpie stew.)   Thanks for everyone's help. I will keep those links they are good tools.     Mark.

You only need to eat crow for the whole "your forum sucks" thing.      As far as falling under an IP block that is just the result of setting up shop in a questionable neighborhood (so to speak) you have every right to want it (and get it) corrected quickly.

Need any help in the future, feel free to return to the forum that does not suck.