Keep Getting Blocked with "Malware" Warning

[Anonymous]

Hey, Jeff....are you sending kooties to conservative posters now? (Don't blow a gasket....I'm just kidding.) For the past two days, when I try to get on a page, my security protection program (Norton) blocks it with an ominous page saying "WARNING: This page has been blocked because malware has been detected." It's happening intermittently. Any ideas? It's not happening with other websites.

[jsteele]

Someone else reported something similar to this a couple of weeks ago and I suggested the problem was with Norton. However, I can't really be sure. Does Norton provide more specific information such as an URL? There are two common ways that a website could be unintentionally infected with malware:

1) malware is embedded in a page by a malicious user posting code that makes it through our security mechanisms or by a hacker modifies a page template;

2) malware spread through malicious advertisements.

I don't think we have experienced the first, but we have had occasional cases of the second.

More commonly, I think that programs like Norton sometimes falsely identify code in advertisements as malicious. In some of these cases, there could be legitimate disagreements whether the code is malicious or not. Some would think it is while other wouldn't.

[Anonymous]

jsteele wrote:Someone else reported something similar to this a couple of weeks ago and I suggested the problem was with Norton. However, I can't really be sure. Does Norton provide more specific information such as an URL? There are two common ways that a website could be unintentionally infected with malware:

1) malware is embedded in a page by a malicious user posting code that makes it through our security mechanisms or by a hacker modifies a page template;

2) malware spread through malicious advertisements.

I don't think we have experienced the first, but we have had occasional cases of the second.

More commonly, I think that programs like Norton sometimes falsely identify code in advertisements as malicious. In some of these cases, there could be legitimate disagreements whether the code is malicious or not. Some would think it is while other wouldn't.

OK, thanks. Yes, I suspect you're right that the fault lies with Norton. In any event, it hasn't happened today, so hopefully I've seen the last of that. If it does recur, I'll make sure to take note if Norton provides a URL.

[Anonymous]

OK, Jeff, it happened again, and this time I was able to copy the URL (or at least part of it): http://paradigm1.online/ln/SOzeGXyAYC00n22FU

Does this mean that there is some malware that is redirecting me from your site to a harmful site? And that would not be the fault of Norton, would it? What's causing the re-direct? (Obviously, I'm not technically savvy.)

[jsteele]

Anonymous wrote:OK, Jeff, it happened again, and this time I was able to copy the URL (or at least part of it): http://paradigm1.online/ln/SOzeGXyAYC00n22FU

Does this mean that there is some malware that is redirecting me from your site to a harmful site? And that would not be the fault of Norton, would it? What's causing the re-direct? (Obviously, I'm not technically savvy.)

This most likely originated with an advertisement. Typically the code that displays an ad does a lot of other things as well. It is normal for there to be a number of redirects before the ad eventually displays. Occasionally, malicious ads attempt to redirect you to an unwanted site. Most commonly, these are pages saying you have won a lottery or the redirect is to an app store. I can't tell from that URL what is was going to do because it is not displaying any content now. The way that I have currently configured my ad slots, there should be no way for ads to to pop-up or redirects that take over the entire screen (this used to happen, but I haven't had any reports of it for some time). More than likely, Norton simply stopped a redirect that was going to fail anyway due to my ad configuration.

[Anonymous]

jsteele wrote:

Anonymous wrote:OK, Jeff, it happened again, and this time I was able to copy the URL (or at least part of it): http://paradigm1.online/ln/SOzeGXyAYC00n22FU

Does this mean that there is some malware that is redirecting me from your site to a harmful site? And that would not be the fault of Norton, would it? What's causing the re-direct? (Obviously, I'm not technically savvy.)

This most likely originated with an advertisement. Typically the code that displays an ad does a lot of other things as well. It is normal for there to be a number of redirects before the ad eventually displays. Occasionally, malicious ads attempt to redirect you to an unwanted site. Most commonly, these are pages saying you have won a lottery or the redirect is to an app store. I can't tell from that URL what is was going to do because it is not displaying any content now. The way that I have currently configured my ad slots, there should be no way for ads to to pop-up or redirects that take over the entire screen (this used to happen, but I haven't had any reports of it for some time). More than likely, Norton simply stopped a redirect that was going to fail anyway due to my ad configuration.

Correct...comes back as malicious on virustotal, but url status is 404.