This page is unsafe

[Scfe5]

It has only started today and I am getting a message from Norton Safe Web.
It states that this page is unsafe and you cannot log.
If you override it you can then log in as I am now.
regards
Ken W

[rufuskins]

I too have the same problem. I checked with Norton for the "false positive" possibility but nothing adverse was reported by them. Could a post have triggered this?

[PeterPeddlesden]

It could be a number of things.

The Site Owner is investigating.

[PeterPeddlesden]

It has been narrowed to a file in the library.

The file is under investigation. So far TWO AV programs has failed it.

[PeterPeddlesden]

Running metascan which utilises numerous Anti Virus and Threat Attack packages, the result was the file in question (ID: 27665) is picked up by 2 AV packages as containing a "potentially unwanted program" called MegaSearch.

Norton and MacAfee both picked this up.

This is different to what rufuskins has reported elsewhere, for whatever reason.

The file is unchanged since upload in March 2012 and only now is it reporting a threat.

It would appear that both Norton and MacAfee are detecting a "False Positive" on the file.

The file has been temporarily removed and replaced by a simple 1K Zip file.

Would those experiencing the THREAT please check again to see if the threat still exists ??
Could you also check other sites where Nobkins uploaded the file, to see if Norton picks up the threat on the other sites.

Thanks for your help in detecting and resolving this issue.

[rogermatthews]

No problem now - thanks for resolving

ROger

[Scfe5]

No Problems encountered today
thank you

[scampispeedway]

Hi Peter, I do most of my downloading from the site using Win 7 partition with Kaspersky Internet Security and get at odd times a warning message
that the file is unsafe to download and could cause problems to my computer.
I usually ignore this message and save it, because in the past I used to change over to the XP partition also with the same Kaspersky Internet
Security and this time it loaded without any warning message.

Bob

[PeterPeddlesden]

Thanks guys.

The UKTrainSim site is now registered with Norton SafeWeb, and we indicated the nature of the misdetection - they have re-analysed and the site is now marked as OK.

[rufuskins]

This is different to what rufuskins has reported elsewhere, for whatever reason.

I assume that you are referring to my post on TSSH where I quoted the Threat Report contained in the Norton warning. The message referred to the UKTS File No 27665!

This was done in order that those who are more computer literate could identify the possible problem.

[gswindale]

Hi Pete,

I've just had the message pop up again with the following listed as the threat

Threat Name: Trojan.Gen.SMH
Location: http://dltest.uktrainsim.com/uktrainsim ... Challenge_

[rogermatthews]

Just to confirm previous post, I'm getting the warnings again!

[PeterPeddlesden]

Thanks guys. 27665 has been quarantined for investigation.

Clearly there have been changes in the Norton and MacAfee scanners that now mark this file as containing all manner of nasties.

Are you still getting the warnings, now that the file has gone ?

[rogermatthews]

I'm no longer getting the 'This is a malicious site ...' warning (which replaces the normal login page) but I am still getting the lesser "this is a suspicious site ... do you wish to [auto]fill anyway" message.

Thanks for all your efforts, Peter, these things must be a real pain.

[rufuskins]

My Norton toolbar states "This page is suspect". However it hasn't blocked it.