Please remove block, we deleted the blog but it is still showing positive..

[birdwell]

Hi, we have a client that is being blocked by the Malwarebytes Chrome Extension.

I requested the site be unblocked earlier but we had a false positive on 
hxxp://cpethink.com/blog/wp-includes/js/jquery/ui/core.min.js

We verified that file is OK but virustotal.com was still reporting it as malware.

So we backed up and deleted the blog completely but virustotal.com is still showing the file exists and is malware.

hxxp://cpethink.com/blog - 404

hxxps://cpethink.com/blog - 404

If you go to any of the links above you get a 404 (as you should) and since there are no other positives may the site please be unblocked?

Many thanks... 

Edited June 3, 2021 by TeMerc
Disabled live links

[birdwell]

Sorry for the duplicate messages.

The site is hxxps://www.cpethink.com

 

Edited June 3, 2021 by TeMerc
Disabled live links

[TeMerc]

13 minutes ago, birdwell said:

Sorry for the duplicate messages.

The site is hxxps://www.cpethink.com

 

Hi, this file is still active

http://cpethink.com/blog/wp-includes/js/jquery/ui/core.min.js

VirusTotal

[birdwell]

Hi, it's not, it's not on the server at all anymore, we deleted it.

If you go to that link you get a 404.

Apologies but what else can we do?

[birdwell]

Hey @TeMerc, 

We deleted the blog, the blog and all WP files are not on the site anymore.

Not sure what virustotal.com is doing but that file is gone.

Would it help to boot the server to clear VirusTotal?

Many thanks... 

[birdwell]

Hi @TeMerc,

I've traced the problem to 2 listings on scumware.org and it is the only scanner reporting any problem.

VirusTotal Security Vendor List - https://www.screencast.com/t/KOzd8SpF

Scumware.org query results - https://www.screencast.com/t/fAocMxozyYj

The files in the Scumware.org query list have been completely removed as well as all WordPress files from our site.  

Is there anything you can help with?  We have cleaned our site and appear to be at the mercy of scumware.org and they are not easy to contact like your company is.

Many thanks, Tad

 

[Porthos]

Just wait until staff goes online again. No new topics needed, I removed the other one.

[birdwell]

Thanks @Porthos, am new and was only getting replies when posting a new Topic.  Sorry about that, waiting, impatiently because we're loosing business but am waiting now.  Thanks again... 😎

[Porthos]

I think the issue is it takes Virus Total time to re sync the results from the reporting vendors. Now staff has to dig deeper manually and that is also time consuming.

Staff are all working remotely and scattered across the world and in different time zones as well.

Edited June 3, 2021 by Porthos

[birdwell]

Makes since but since scumware.org is still reporting the positive, VirusTotal just picks that up and then Malwarebytes picks that up.

Out of all the security vendors VirusTotal aggragates scumware.org is the only one reporting bad files and the files don't even exist.  So even if VirusTotal re-syncs their still going to get that we have bad files and we don't.

It's just frustrating that you can't get ahold of anyone at scumware.org and it's killing our site.  Booting the server tonight to clear cache's and see if that helps.

Thanks again for your help. 

[Porthos]

Now deal with quttera listing on VT, the rest are clear now from what I see.

https://www.virustotal.com/gui/url/d7ca874295d100c48b01305e7c8d88f495adbbdbeedc44db47bf210bb3a0e95b/detection

Report incorrect detection or false positive on helpdesk.quttera.com or send an email to support@quttera.com

Edited June 3, 2021 by Porthos

[birdwell]

Apologies but I'm new to this.

I didn't see a a quterra listing on VT for our site.  Are you saying they can be a struggle or that I should submit an incorrect detection?

Thanks again... 

[birdwell]

Hmmm, now Quterra is show "Suspicious" when they weren't before on our blog directory and it's not even there.... 

[Porthos]

2 minutes ago, birdwell said:

I didn't see a a quterra listing on VT for our site.

2 minutes ago, birdwell said:

that I should submit an incorrect detection?

You should, they are pretty fast, had to do one foe my site in the past, That is why I the contact info handy.😎

[Porthos]

You 40x page is up in the blog. But the issue is the script pointed out to you.

 

[birdwell]

Awesome, that wasn't even there this morning but is now.  Just submitted a ticket to remove a false positive for hxxp://cpethink.com/blog and the subdirectory doesn't even exist.  Will do a ticket for the main domain as well.  Thanks again and let me know anything I can do for you, your help is much appreciated.  

[birdwell]

6 minutes ago, Porthos said:

You 40x page is up in the blog. But the issue is the script pointed out to you.

What script are you referring to?  All the WP scripts are gone, we deleted the entire subdirectory.

[Porthos]

1 minute ago, birdwell said:

What script are you referring to?  All the WP scripts are gone, we deleted the entire subdirectory.

Now it 404, probably not an issue any longer but staff will respond asap.

Edited June 3, 2021 by Porthos

[birdwell]

Got it, that script, and all the other WP files, were deleted about 2 hours ago.  

We updated our menus and links we could find so far so unless someone is going direct they shouldn't even get the 404 page.

 

[JPopovic]

Hello,

The block will be removed.

Thank you!

[birdwell]

Hi @JPopovic - you are awesome, many thanks...