Blog Owners, Logging In To Blogger, Receiving Malware Warnings

We've been seeing a few problem reports, in Blogger Help Forum: Something Is Broken, from blog owners seeing malware warnings for unknown blogs or websites.

I get a warning from Google Chrome, when I login to Blogger.

Content from www.unknownblog.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your computer with malware.

We know that our blogs are subject to malware and spam classification - but now we see that we can also get warnings for other blogs and websites, that we don't own.

A blog owner, seeing this warning when logging in, will probably find the source of the problem in the Reading List, where content from other people's blogs is routinely found. In some cases, the problem will be in blogs that are intentionally Followed, and blatantly contain malware - and in other cases, blogs that are intentionally Followed may be redirecting the post feed, in a vain attempt to extend their reader base.

In either case, the only solution is to identify the problem blog or website, by examining each individual Reading List entry, one by one, until the noted blog or website is found - then discontinue Following the problem blog or website.

One mysterious scenario can involve blogs using favicons which are detected as malicious, by image scanning malware protection - or which are hosted from a domain which is known for malicious activity. Favicons, tiny icons which represent a blog or website, are used to decorate blog headers and feed gadgets, and are sometimes served by third party services. A "malicious" favicon may be found on entries in the Reading List, or on entries in a bloglist, which will then affect our readers ability to view our blogs.

The bottom line here is that we are responsible for the content of the blogs and websites which we link to from our blogs - and which we Follow - as well as the content on our own blogs.

>> Top

We Are At The Mercy Of Every Anti-Malware Protection Program Imaginable

We see reports, from time to time, in Blogger Help Forum: Something Is Broken, about blogs which people can't read, from their computers.

One of my readers claims that I have a virus on my blog. He provided the following information:

AVG anti-virus detected the following threat on the site:

File Name: www.mydomain.com/favicon.ico

Threatname: Exploit Black Hole Exploit Kit

How do I fix this?

Similar to the many reports that we process here, about spurious spam classification, the above report is frequently determined to be a false positive. An anti-virus alert, even if a false positive, is generally not as simple to resolve as a spurious Blogger spam classification, though.

One of the frustrating problems with false malware alerts is that they come from so many different anti-malware products.

I've contributed my opinion about computers, and the suggestion that no two privately owned computers are identical, many times. One way which many computers vary is the complement of security software, which is chosen by each different computer owner.

At any time, any different anti-malware product may decide that some component of your blog is unsafe.

• Maybe, a single file mentioned in your blog code (as above, "favicon.ico") is suspect.
• Maybe, content hosted by "blogspot.com" is unsafe.
• The code may be an accessory that we added, intentionally.
• The code may be content in another blog - hosted by your blog in a bloglist, a linklist, or maybe in the Reading List on your dashboard.

In either case, you (or your reader) won't be allowed to view the blog - or may be allowed to view the blog, but given a stern warning which very few chose to accept.

Like many problems with layered security, any malware detection can come from

• A native browser filter.
• A filter in a browser add-on.
• A filter installed on the computer.
• A filter in a network appliance.

Listen to your computer. some time. Your anti-virus protection may update automatically - and may audibly announce the update. On a typical day, I hear the Avast client on my several computers announce an update, several times - and I am not (contrary to some misconceptions) seated in front of my computer on a 24 x 7 basis.

Avast (my personally and professionally recommended choice, to many people) is only one of dozens of various anti-malware products which receives automatic updates, when the host computer is online. Any one of these products may be updated, at any time -and somebody's access to your blog (or my blog) becomes blocked.

If you get a message from one of your would be readers

I can't view your blog!

this could be someone reporting that your blog just went offline, for one reason or another - or it can be someone just discovering that the anti-malware program, on his computer, has decided that BlogSpot hosted content is unsafe. In either case, there is not a lot that you can do, except wait it out - and concentrate on the readers who can access your blog.

>> Top

Blogger Blogs Lack The Navbar, Though Not Removed By The Owner

Recently, a few Blogger blog owners are looking at their blogs and wondering

Where is my Navbar?

or

Why don't I have a "Sign In" ("Sign Out") link, at the top of the page?

When investigating further, they may discover that none of the blogs, that they view, shows the Navbar. And, they did not intentionally make any template changes, to their blog, to hide the navbar.

Many of these people, later investigating the problem in Blogger Help, learn that their browser, or another anti malware product, is blocking the navbar as suspicious code. This is another example of improperly configured layered security, planned to protect our computers.

If you are observing the lack of the navbar on your computer, and you request help in Blogger Help, please help us to help you better, and provide details.

• What browser (name and version - and precision matters) are you using?
• What add-ons are installed, in the browser (completeness matters)?
• What anti malware product(s) do you use, on your computer (again, completeness matters)?

If we can get an idea of what components are involved in this problem, maybe we can isolate the problem, itself. Please, be complete - and be precise.

>> Top

Norton Safe Web Is Claiming That All BlogSpot Blogs Are Fraudulent

We are seeing a steadily increasing flood of reports, in Blogger Help Forum: Something Is Broken, from people who use Norton Safe Web, and who are now seeing some distressing advice.

When I try to view any BlogSpot blog, I see

This web page is a known fraudulent web page. It is recommended that you do NOT visit this page.

For your protection, this web page has been blocked. Visit Symantec to learn more about phishing and internet security.

What is Google doing about this false alert?

Since Norton (aka Symantec) is not a part of Google, there is not a lot that Blogger or Google can do about this problem.

You have just 2 choices, with this problem.

1. Get help from Norton.
2. Get rid of Norton.

Norton is a third party product. Like all third party products, neither Blogger nor Google supports Norton.

Blogger does not control what accessories you run, on your personal computer. That's your choice - and that's your responsibility, to support.

---

(Update 20:30 PST): One blog owner claims to have had a Live Chat with an online Symantec representative, with a promising result.

This is an ongoing issue with the Symantec server and we are aware of this issue & working on it to get it fixed. I request to run the Live Update after 24 hours until all the updates are installed and check the status.

And subsequently,

I just ran live update... FOR me the problem is fixed.

---

>> Top