Author Topic: Avast has blacklisted Ripway again  (Read 4386 times)

0 Members and 1 Guest are viewing this topic.

coltpixy

  • Guest
Avast has blacklisted Ripway again
« on: October 17, 2009, 08:51:51 PM »
I love Avast I have been using it for years. I also love using Ripway as an image/file host. Been using them for years too.
The last time this happened I was told that it was because Ripway had accidentally been blacklisted and it was fixed right away. Now it is happening again. The favicon and other images hosted by Ripway on my blog were not showing up so I went to log in at Ripway and my Avast started screaming and throwing up warnings. Just logging into the front page of Ripway.

If Avast is going to keep blacklisting them could someone please let me know of another good host for .ico and .pdf files? I can just use PhotoBucket and Flickr to host images for my blog.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67195
Re: Avast has blacklisted Ripway again
« Reply #1 on: October 17, 2009, 09:03:25 PM »
Hope they correct the false positive soon.
But... are you sure the site wasn't hacked and it is really a false positive? ???
The best things in life are free.

coltpixy

  • Guest
Re: Avast has blacklisted Ripway again
« Reply #2 on: October 17, 2009, 10:55:53 PM »
I emailed Ripway. It was not easy to get to anything on their website because every single page, even the help pages are setting off warnings on Avast. I hope that Ripway and Avast can get it straightened out soon.
It has to be a false positive.

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11658
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Avast has blacklisted Ripway again
« Reply #3 on: October 17, 2009, 10:58:04 PM »
Can you please do a screenshot of the warning?
If at first you don't succeed, then skydiving's not for you.

spg SCOTT

  • Guest
Re: Avast has blacklisted Ripway again
« Reply #4 on: October 17, 2009, 11:03:16 PM »
It is a webshield detection.

Network shield=blacklist

Webshield= alert based on detection...

Being a webshield detection, it would appear that this is accurate and it seems that the favicon.ico of the the site has been hacked. I get two alerts on this, just visiting the homepage:

Code: [Select]
10/17/2009 9:56:32 PM 1255812992 SYSTEM 1516 Sign of "HTML:Script-inf" has been found in "http://www.ripway.com/favicon.ico" file. 
10/17/2009 9:56:35 PM 1255812995 SYSTEM 1516 Sign of "HTML:Script-inf" has been found in "http://www.ripway.com/favicon.ico" file. 


coltpixy

  • Guest
Re: Avast has blacklisted Ripway again
« Reply #5 on: October 18, 2009, 12:17:24 AM »
Well since that is where I normally host screen shots  :(

All of the warnings say the same number on them...
file name h**p://ripway. com
Malware name HTML Script-inf
Malware type Virus/Worm
VPS version 091017-0, 10/17/2009

I did email Ripway support and even gave them a link to this thread. The last time Ripway and Avast worked together. But that time I was not getting warnings from Ripway's website like I am now.
« Last Edit: October 18, 2009, 03:32:46 AM by coltpixy »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Avast has blacklisted Ripway again
« Reply #6 on: October 18, 2009, 01:36:29 AM »
Please 'modify' your post change the URL from http to hXXp or www to wXw, to break the link and avoid accidental exposure to suspect sites, thanks.

For Vlk, image1 is the alert, there are two consecutive alerts on the home page, when it tries to load the favicon.ico file.

OK it looks like the site has been hacked and the favicon.ico file has been modified, see image2, that points to a probable malicious site 8866.org:
Quote
Registrant City:Changzhou
Registrant State/Province:Jiangsu
Registrant Country:CN
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

coltpixy

  • Guest
Re: Avast has blacklisted Ripway again
« Reply #7 on: October 18, 2009, 03:36:45 AM »
Thank you so much guys!
One thing I would like to point out, I am so very glad that Avast works when it needs to.
So I guess I am off to search Google for another file host. Thank you all so much for helping me out with the information.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88900
  • No support PMs thanks
Re: Avast has blacklisted Ripway again
« Reply #8 on: October 18, 2009, 03:14:33 PM »
You're welcome.

There is unfortunately that in finding a new host, that they (and subsequently your site) too won't get hacked in the same way. It is at that point that you find out just how good they are support wise.

- This is commonly down to old content management software being vulnerable, PHP, Joomla, Wordpress, SQL, etc. etc.

-- Every 3.6 seconds a website is infected http://forum.avast.com/index.php?topic=47096.msg396648#msg396648.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

coltpixy

  • Guest
Re: Avast has blacklisted Ripway again
« Reply #9 on: October 18, 2009, 07:37:40 PM »
My blog did not get hacked. After Ripway was hacked or whatever happened to them, the images and favicon that I had hosted at Ripway disappeared from my blog.