64

I recently came across a question which contained a link to a website hosting the related project. When I clicked the link, my virus protection started acting up, stating that the page was infected and contained malicious content.

Since I found no normal flags that adress this issue, I flagged the question as "requires moderation attention" with the following explanation:

I'm getting a website infected threat warning when visiting the website that is supposed to host the askers code in question

The flag was disputed with the following reaction:

declined - flags should only be used to make moderators aware of content that requires their intervention

I could be mistaken here, but isn't a link to an infected website exactly the kind of content that desires intervention?

If not, then how should this question be flagged?

As I'm aparently the only one getting the virus scanner warning, I'll include the content my virus scanner has found on the website:

High Risk Website Blocked
Location: winstonduke.com
Access has been blocked as the threat VBS/Inor-AA has been found on this website.
Return to the page you were previously viewing.*

10
  • Can you post the link here ? I'm curious. Commented May 11, 2015 at 14:39
  • @JonasCz Hyperlinked it. There are probably multiple reasons to close it, but my question refers to questions in general that contain malicious content.
    – timo
    Commented May 11, 2015 at 14:40
  • 16
    @JonasCz Might be my virus scanner is over-reacting but that does not change the nature of my question. I'm not quite sure what your linked question has to do with mine apart from the fact that they are about malicious content. My question is about posters that post a link with malicious content, wether it's intentional or not the OP does not mention there is malicious content on the included link. Your link is about openly discussing malicious content.
    – timo
    Commented May 11, 2015 at 15:13
  • 4
    You can flag for mod attention, explain precisely what is going on, and a mod should act on it. If they don't, as was the case here, you can post on meta, as you did. For me, there does not seem to be anything malicious about that link, and a mod probably thought the same thing. I'm sure the mod who declined your flag will explain his reasoning here. Commented May 11, 2015 at 15:19
  • 5
    @user1129884 when flagging for moderator attention, it is extremely important you be precise. Tell the mod (1) exactly what is wrong, (2) why it is wrong, and (3) what you need them to do with it that you cannot do on your own. #3 is very important because mods are not necessarily mind readers. They get flags all of the time about "please answer this question" and similar non-issues, so unless your message is clear, they can't know what you expect them to do. Do you want them to edit? To delete the question? Suspend the user? Send a unicorn army to deal with this virus? Commented May 11, 2015 at 15:32
  • 13
    Also note that the flag told you that moderator intervention wasn't necessarily required. Perhaps a comment or a suggested edit could have helped. Only flag for moderator attention when the community itself cannot handle the situation directly by themselves. Moderators are very, very busy people!
    – Martijn Pieters Mod
    Commented May 11, 2015 at 15:58
  • 3
    The virus scanner actually says the following to you: "At some point in the past, some page of that website was found to be infected. Because of that let's block the whole website for indefinite period of time!"
    – Xan
    Commented May 12, 2015 at 21:32
  • I think it would have been good to have this tested by a anti virus site (there are a couple of out there) since this is not giving me a hit on AVG or Mcafee
    – Sammaye
    Commented May 13, 2015 at 13:45
  • Nor on Chrome which also checks Googles own Virus scanner built into its crawler
    – Sammaye
    Commented May 13, 2015 at 13:46
  • 2
    On bad links I've always edited the question, and then raised a custom moderator flag to request that the original question content be purged from the database (which has to be forwarded to a developer).
    – AStopher
    Commented May 14, 2015 at 7:40

3 Answers 3

27

The diagnostic tool from Google says the following.

Safe Browsing

Diagnostic page for winstonduke.com

What is the current listing status for winstonduke.com?

This site is not currently listed as suspicious.

What happened when Google visited this site?

Google has not visited this site within the past 90 days.

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, winstonduke.com did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

Personally, I dislike the report from Sophos. As bluefeet pointed out, it doesn't give you any time period when the malware was found on the site itself (it does give you a "Protection available since:" date in 2010 and it does give you a "Last Update:" in 2011, but these dates are meaningless to me, also they're really old even if they were meaningful). So in other words, Sophos doesn't give you any verifiable analysis, or any possibly falsifiable claim.

If sophos.com continues being a problem on StackOverflow, and continues giving warnings without useful information, I'd suggest that StackOverflow blacklists it as malware/alarm-ware/spamware itself, and automatically prevent users from entering that url in questions or comments.

That being said, had Sophos given a more verifiable report with an actual time frame, or with an actual date of the discovery on the site itself, or better yet, should another more mainstream scanner had agreed with Sophos, I think the first person who finds the problem should edit the question and post a warning next to the link in question (while at the same time, making the url non-clickable, but still make the url human-readable and copyable for those who want to double-check it. And also post the link to the site that actually gave him/her the warning/finding as well).

A warning in the comment is great, as was done in this case, but unfortunately by the time someone gets to that comment, he/she may already have clicked on the link, and already infected his/her computer.

Ideally, this should not even require the intervention of a moderator (unless there is suspicion that the malicious site was posted on purpose). And if the user doesn't have enough reputation to quickly edit the question, or is waiting for others to approve his edit, he should at least post the warning as a comment. Other users with high enough reputation (who we assume agree with the warning given) can always do the rest.

1
  • 9
    I like this aproach. You've given me tools to check for a false positive. Also, an edit can prevent damage that might otherwise already be done by the time a user reaches the comments.
    – timo
    Commented May 13, 2015 at 7:01
28

I was the moderator that handled the flag and I declined it. Your flag was:

I'm getting a website infected threat warning when visiting the website that is supposed to host the askers code in question.

What exactly did you expect us to do here? You didn't include any explanation on what action you needed us to take. Did you want it deleted? Did you want it edited? What?

I went to the site and didn't have any issues. There was nothing for me to do, so I declined the flag.

When flagging for a moderator, please be as specific as possible on what you expect us to do. Moderators are human exception handlers and should only get involved when the community cannot. This question and the link was not one of those times.

8
  • 21
    I'm still in dubio about what to do when I reach another situation like this. Your answer seems to imply I did use the correct flag, only I was not specific enough. And the fact that you did not receive a warning does not help my case either. Should I in the future: 1. Suggest an edit, removing the link, stating I get a virus warning. OR 2. Flag as needs moderator attention with a more detailed explanation, including my virus warning, and requesting the post to be removed?
    – timo
    Commented May 12, 2015 at 6:45
  • 1
    @user1129884 In this particular case you also have the heavy burden of proving that your virus scanner is not throwing up a false positive. Until you can actually do that you're only flagging a -possible- infection, not a proven infection. I'm no mod, but I'd say that is only worth a comment and not a flag.
    – Gimby
    Commented May 12, 2015 at 11:36
  • @user1129884 When asking a moderator to do something, you have to provide us with as many details as possible in order to accurately decide how to handle the situation.
    – Taryn Mod
    Commented May 12, 2015 at 12:06
  • 4
    @bluefeet Your comment about the lack of details was not unheard, and when I'm forced to flag for moderator in the future, I will provide all the details as possible. My question about what to do in this situation is still unsolved though. 1.Flag 2.Edit or 3.Comment . I can understand Gimby's point of view that It's hard to get sufficient proof of a site actually being infected and that a comment is most likely the safest way to go in these situations.
    – timo
    Commented May 12, 2015 at 12:24
  • @user1129884 Well, considering I cannot reproduce the issue, you might want to comment to the user that their website is throwing a warning.
    – Taryn Mod
    Commented May 12, 2015 at 12:29
  • 13
    Is there a better "declined" reason that could have been used? I'm not familiar with what the options are but maybe something equivalent to "could not reproduce" or "whatchoo talkin bout willis"?
    – Keith
    Commented May 12, 2015 at 17:52
  • @Keith We can add a custom decline reason when needed. It's possible that I should have used that instead but again this isn't really something that a mod needed to be involved in.
    – Taryn Mod
    Commented May 12, 2015 at 17:54
  • 18
    I agree that no moderator action should be taken here, but this answer seems wrong for the general case. The problem was described in sufficient detail, the solution should be decided by the moderator - non-moderators should not be expected to know exactly what the best action for moderators are in any given scenario (not to mention many probably not even knowing which actions are available to moderators). Commented May 13, 2015 at 14:01
1

If the post isn't self-contained and you thus need to follow the link to get a complete picture (or so you believe, if the link doesn't give any more information), flag it as "Unclear what you're asking" (or "Not an answer" for answers). You could instead edit the post, removing the link and copying any content from the link into the post.

If the post contains mainly a clearly bad link (without meaningful content in the post itself), you could also consider flagging it as spam (this is treated much more harshly than simple Unclear content, so it should be justified).

If a post contains a bad link, but the post is self-contained (thus the link contains additional, but not required, information), simply editing the bad link out might be an appropriate action.

In any case, a comment would be helpful:

  • Telling other users that the link is likely bad.
  • Telling the asker what's wrong with their post (also helpful for other users) and how to fix it and possibly to host their content on some well-known site instead.

As others seem to indicate, it looks like it's actually a false positive. You may want to take some steps to reduce the chance of taking action for false positives such as those Stephan used (but often action needs to be taken regardless of whether or not it's a bad link).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .