That specific file may not have been infected, the whole site could be
blocked for any malware detected on the site. I know Bitdefender didn't
alert on any of the packages downloaded at other mirrors, so its not a
false alarm on the original content. I was concerned either this was a
rouge mirror or had been hacked and was apart of a watering hole attack.
Its not just Bitdefender, please see following VirusTotal site report:
https://www.virustotal.com/en/url/0d5e38cd95d4b1eba29ccb3679d2667b9079a85...
URL:http://mirror.redsox.cc/Detection ratio:2 / 63Analysis date:2015-05-03
10:23:40 UTC ( 1 week, 1 day ago )
0
1
- Analysis
<
https://www.virustotal.com/en/url/0d5e38cd95d4b1eba29ccb3679d2667b9079a85...
- Additional information
<
https://www.virustotal.com/en/url/0d5e38cd95d4b1eba29ccb3679d2667b9079a85...
- Comments 0
<
https://www.virustotal.com/en/url/0d5e38cd95d4b1eba29ccb3679d2667b9079a85...
- Votes
<
https://www.virustotal.com/en/url/0d5e38cd95d4b1eba29ccb3679d2667b9079a85...
URL ScannerResultBitDefenderMalware siteCRDFMalicious siteADMINUSLabsClean
siteAegisLab WebGuardClean siteAlienVaultClean siteAntiy-AVLClean site
AutoShunUnrated siteAviraClean siteBaidu-InternationalClean siteBluelivClean
siteC-SIRTClean siteCLEAN MXSuspicious siteComodo Site InspectorClean site...
[cut]
On Mon, May 11, 2015 at 9:01 AM, Brian Lancaster <brianlan(a)gmail.com> wrote:
I dont think so guys, can you please provide the complete URL to this
file
you think is questionable.
BTW: this server is simply a mirror from a master server, if it contains a
bad file, its been rsync'd down.
Thanks for the concern though!
On Mon, May 11, 2015 at 3:00 AM, Adrian Reber <adrian(a)lisas.de> wrote:
> On Mon, May 11, 2015 at 01:43:39AM -0500, Adam Vance wrote:
> > Bitdefender has been tripping alerts on mirror.redsox.cc, the website
> is
> > blocked by Bitdefender and the downloaded packages are being blocked as
> > infected.
> >
> > I've attached a screenshot for your reference. Please advise, thanks!
>
> Thanks for you report. I added the mirror admin of mirror.redsox.cc also
> on CC. I checked the file from mirror.redsox.cc with the file on the
> master mirror and they are exactly the same. I looked at the file and it
> is just compressed XML. So this seems to be a false alarm of
> Bitdefender. At least for the file in your screenshot.
>
> Adrian
>
>
--
Brian Lancaster