This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=1145

hhrhhr, posted Wed Jul 08, 2015 2:55 pm (6223)

---

i use secure Yandex DNS-servers, today found that the site is considered to be "infected". translated message:

Quote:

Yandex periodically checks the sites to warn users of dangerous pages. Last checked (less than two days old) showed that the site was placed malicious code. This could be either at the request of the owners, and without their knowledge - as a result of malicious acts.

Malicious code:

It contains Mal / JSShell-B (according to the company Sophos).

it's not a problem for me, but i would in your place would have written in support of Sophos about false positives.

aluigi, posted Wed Jul 08, 2015 3:55 pm (6227)

---

Thanks for the info.
Honestly I don't have the minimal idea of what it means, first because in the last months I have updated only quickbms and the scripts (the rest of the website is untouched), then because there is not a name of file or other additional information and then there is nothing even similar to code like this (the metasploit code that is probably related to that Mal / JSShell-B).

The files online are 100% original so I guess it's one of the usual false positives coming from my old open source proof-of-concepts.

aluigi.altervista.org is reported ok (aluigi.org is simply a redirect to aluigi.altervista.org, it contains nothing).

Anyway the problem is yandex. Sophos is simply used as a link to the information of what has been found.

Are you using the DNS 77.88.8.88/2 ?

aluigi, posted Wed Jul 08, 2015 4:24 pm (6229)

---

Mah, in the meantime I have used https://feedback2.yandex.com/dns/nophishing/ to report the false positive.

hhrhhr, posted Wed Jul 08, 2015 6:32 pm (6234)

---

Code:

77.88.8.88, 77.88.8.2, 77.88.8.7, 77.88.8.3:
aluigi.org.             1200    IN      A       213.180.193.250

77.88.8.8, 77.88.8.1:
aluigi.org.             10800   IN      A       217.70.184.38
aluigi.org.             10800   IN      NS      c.dns.gandi.net.
aluigi.org.             10800   IN      NS      a.dns.gandi.net.
aluigi.org.             10800   IN      MX      50 fb.mail.gandi.net.
aluigi.org.             10800   IN      MX      10 spool.mail.gandi.net.
aluigi.org.             10800   IN      SOA     a.dns.gandi.net. hostmaster.gandi.net. 1355402945 10800 3600 604800 10800
aluigi.org.             10800   IN      NS      b.dns.gandi.net.

aluigi.altervista.org works ok. I tried to inform the Yandex of false positives, but usually reach them as difficult as for Google

aluigi, posted Wed Jul 08, 2015 7:27 pm (6236)

---

Ok, please keep me updated if something changes in the next days/weeks.