Problem with website detection

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

I mean Is it blocking in your case, or, keeps loading, or, showing that fake gui ??

September 7, 2021

Hello @Apal,

Thank you for posting back!

Neither.

Use How to start your PC in Safe Mode.

OR:

In Windows Search🔎 , type msconfig

Select System configuration app

Select Boot tab

Select Safe boot

Select Apply

Select OK

Select Restart

To revert to Windows normal mode, select General tab, select Selective startup, select Apply, select OK, select Restart.

Thank you🙏

Flood🐳 +🐋

Still not working, I think I have to lodge a complaint with the support team.

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

I mean Is it blocking in your case, or, keeps loading, or, showing that fake gui ??

Hello,

Here it is in my side.

Regards.

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

I mean Is it blocking in your case, or, keeps loading, or, showing that fake gui ??

Hello,

Here it is in my side.

Regards.

But, before this patch, it used to block every pop up and redirects.

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

I mean Is it blocking in your case, or, keeps loading, or, showing that fake gui ??

Hello,

Here it is in my side.

Regards.

But, before this patch, it used to block every pop up and redirects.

Hello,

Please access to this url and try to download the EICAR text file, Does KL product block downloading? It should be blocking to access.

https://www.eicar.org/?page_id=3950

Regards.

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

I mean Is it blocking in your case, or, keeps loading, or, showing that fake gui ??

Hello,

Here it is in my side.

Regards.

But, before this patch, it used to block every pop up and redirects.

Hello,

Please access to this url and try to download the EICAR text file, Does KL product block downloading? It should be blocking to access.

https://www.eicar.org/?page_id=3950

Regards.

Yes, it's blocking

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

I mean Is it blocking in your case, or, keeps loading, or, showing that fake gui ??

Hello,

Here it is in my side.

Regards.

But, before this patch, it used to block every pop up and redirects.

Hello,

Please access to this url and try to download the EICAR text file, Does KL product block downloading? It should be blocking to access.

https://www.eicar.org/?page_id=3950

Regards.

Yes, blocking

September 7, 2021

Hello @Apal,

Kaspersky denies the download, image 6 & Kaspersky report, image 7:

Thank you🙏

Flood🐳 +🐋

INC000013174884

This is the complaint ID, I have lodged just now

September 7, 2021

Hello @Wesly.Zhang,

😅

No popup is blocked, Kaspersky blocks the d/l.

TVM!

Flood🐳 +🐋

I hope you all can understand my problem with these screenshots. See in the last screenshot it has been redirected to a new page.

Hello, @Apal

Now, I know which place is related to the issue. I see some remote js files have been involved in this website. The related issue is that y2mate.com use a bad Advertisers or the purpose itself is not simple. One remote JS file is a fake av GUI. the others is ad page. So I will report this case to KL, Let them determine the reputation score of this website. If I receive any reply, I will post here.

BTW. In my side, the redirection hasn’t been blocked just like you. But the product block the remote js file which been loaded by browsers. It will seem that the redirection page always shows the status of "Loading...".

Regards.

I mean Is it blocking in your case, or, keeps loading, or, showing that fake gui ??

Hello,

Here it is in my side.

Regards.

But, before this patch, it used to block every pop up and redirects.

Hello,

Please access to this url and try to download the EICAR text file, Does KL product block downloading? It should be blocking to access.

https://www.eicar.org/?page_id=3950

Regards.

Yes, blocking eicar sites.

And, my problem is related to anti banner, because the fake advertising redirects are blocked by anti banner earlier not web antivirus.

September 9, 2021

Hello @Wesly.Zhang,

We can’t get to that site.

Thank you🙏

Flood🐳 +🐋

Today, it’s blocking successfully (screenshot attached) and in opentip they are now showing it as adware which they were previously showing as ‘no information’. But, still it’s not blocking redirections made by other youtube video downloader website.

I think kaspersky is very weak in detecting these things.

September 9, 2021

Hello @Apal,

Thank you for the update👌

Have you shared your latest findings with the Kaspersky Technical Team?

IF “no”, please do so.
IF “yes”, what did they say?

Thank you🙏

Flood🐳 +🐋

September 9, 2021

This seems to be very helpful for me. Jet2Holidays discount code

September 9, 2021

@Apal For Adware issues please see this important Topic from @richbuff

Link

September 10, 2021

Hello, @Apal

KL virus lab reply me the following information today:

We will added new heuristic detections "HEUR:AdWare.Script.Generic".
The following redirected URLs were added to blocklist:
boustahe[.]com
jashautchord[.]com
itgiblean[.]com
hetaruwg[.]com
faiwastauk[.]com
hauphuchaum[.]com
jighucme[.]com
mahaidroagra[.]com
oataltaul[.]com
oossautsid[.]com
pignuwoa[.]com
silsautsacmo[.]com
taigrooh[.]net
teeglimu[.]com
thefreshposts[.]com
thompaur[.]com
tobaitsie[.]com
totaltopposts[.]com
zauglomo[.]net

Regards.

September 13, 2021

Hello @Apal,

Thank you for the update👌

Have you shared your latest findings with the Kaspersky Technical Team?

IF “no”, please do so.

IF “yes”, what did they say?

Thank you🙏

Flood🐳 +🐋

Just now, support team responded.

Dear customer,

Hello,

Our Escalation Team have just replied to us, and we'll need just a bit more info from you, could you please help us with it?

1. In the other tickets, you mentioned that after update to patch 'f' the rules for Anti-Banner got reset and had to be configured anew. Does the issue with popups at y2mate.com still persist with enabled Anti-Banner? If yes, what region is you located in? Which filters are enabled under Settings -> Protection -> Anti-Banner -> List of filters?

2. Regarding the issue of redirect at y2mate.com to other sites. We have checked with our Web Content Analysts, and we have tuned our anti-phishing signatures and improved detection technologies to proactively block this kind of threats.

There is an ongoing struggle between the good and the evil, and sometimes it takes a while to catch up, when the redirects use some new, not known previously to the Kaspersky product algorithm.

3. As you mentioned some other sites, where redirects are not blocked: "still it doesn't block redirects of other similar websites."
Please provide us examples, so that we can test and improve the detection.

Thanks a lot and have a great day.

[xxxxxxxxxx] Customer Service Representative

Currently, I am giving them the info. Also, thanks for giving time. Actually, Kaspersky is already good at blocking main phishing websites and main threats (it even saved me from a adware), but, since, there is always a scope of improvement, so, I am reporting multiple bugs to them and in this community. So, kindly don't mind the bad language I have used while creating this post 😇😊

September 16, 2021

Hello, @Apal

KL virus lab reply me the following information today:

We will added new heuristic detections "HEUR:AdWare.Script.Generic".
The following redirected URLs were added to blocklist:
boustahe[.]com
jashautchord[.]com
itgiblean[.]com
hetaruwg[.]com
faiwastauk[.]com
hauphuchaum[.]com
jighucme[.]com
mahaidroagra[.]com
oataltaul[.]com
oossautsid[.]com
pignuwoa[.]com
silsautsacmo[.]com
taigrooh[.]net
teeglimu[.]com
thefreshposts[.]com
thompaur[.]com
tobaitsie[.]com
totaltopposts[.]com
zauglomo[.]net

Regards.

Dear customer,

Thank you for your continued support. I apologize for my delayed response.

Our Virus Analysts have just replied to us with the following information.

We added some rules to block popups on y2mate.guru. Changes will back in a few hours.
Anyway, I see many blocked scripts on y2mate.com. If they are correct, this is a compromised website and we can't do much for Anti-banner.

not-a-virus:HEUR:AdWare.Script.Generic
https://www.y2mate.com/themes/js/common.js?v=3.302 . />https://www.y2mate.com/sw3461575.js?v=3.1.323&o=6a4e0728b9384286a8da6fd5224c8ec7&pub=0&p=4279460 />
Give us a call in case you need further assistance, our numbers and business hours are one click away: http://support.kaspersky.com/b2c />
Have a great day!

Bhuwan || Customer Service Representative

So, what should I do now ?

September 16, 2021

Hello @Apal,

Thank you for the update👌

Have you shared your latest findings with the Kaspersky Technical Team?

IF “no”, please do so.

IF “yes”, what did they say?

Thank you🙏

Flood🐳 +🐋

Just now, support team responded.

Dear customer,

Hello,

Our Escalation Team have just replied to us, and we'll need just a bit more info from you, could you please help us with it?

1. In the other tickets, you mentioned that after update to patch 'f' the rules for Anti-Banner got reset and had to be configured anew. Does the issue with popups at y2mate.com still persist with enabled Anti-Banner? If yes, what region is you located in? Which filters are enabled under Settings -> Protection -> Anti-Banner -> List of filters?

2. Regarding the issue of redirect at y2mate.com to other sites. We have checked with our Web Content Analysts, and we have tuned our anti-phishing signatures and improved detection technologies to proactively block this kind of threats.

There is an ongoing struggle between the good and the evil, and sometimes it takes a while to catch up, when the redirects use some new, not known previously to the Kaspersky product algorithm.

3. As you mentioned some other sites, where redirects are not blocked: "still it doesn't block redirects of other similar websites."
Please provide us examples, so that we can test and improve the detection.

Thanks a lot and have a great day.

[xxxxxxxxxx] Customer Service Representative

Currently, I am giving them the info. Also, thanks for giving time. Actually, Kaspersky is already good at blocking main phishing websites and main threats (it even saved me from a adware), but, since, there is always a scope of improvement, so, I am reporting multiple bugs to them and in this community. So, kindly don't mind the bad language I have used while creating this post 😇😊

They have replied above thing today. What should I do now ? I am confused.

September 17, 2021

Hello, @Apal

KL virus lab reply me the following information today:

We will added new heuristic detections "HEUR:AdWare.Script.Generic".
The following redirected URLs were added to blocklist:
boustahe[.]com
jashautchord[.]com
itgiblean[.]com
hetaruwg[.]com
faiwastauk[.]com
hauphuchaum[.]com
jighucme[.]com
mahaidroagra[.]com
oataltaul[.]com
oossautsid[.]com
pignuwoa[.]com
silsautsacmo[.]com
taigrooh[.]net
teeglimu[.]com
thefreshposts[.]com
thompaur[.]com
tobaitsie[.]com
totaltopposts[.]com
zauglomo[.]net

Regards.

Dear customer,

Thank you for your continued support. I apologize for my delayed response.

Our Virus Analysts have just replied to us with the following information.

We added some rules to block popups on y2mate.guru. Changes will back in a few hours.
Anyway, I see many blocked scripts on y2mate.com. If they are correct, this is a compromised website and we can't do much for Anti-banner.

not-a-virus:HEUR:AdWare.Script.Generic
https://www.y2mate.com/themes/js/common.js?v=3.302 . />https://www.y2mate.com/sw3461575.js?v=3.1.323&o=6a4e0728b9384286a8da6fd5224c8ec7&pub=0&p=4279460 />
Give us a call in case you need further assistance, our numbers and business hours are one click away: http://support.kaspersky.com/b2c />
Have a great day!

Bhuwan || Customer Service Representative

So, what should I do now ?

Hello,

It should be blocked correctly in that website. How about your side?

Regards.

September 19, 2021

@Wesly.Zhang

Currently, it’s working perfectly. So, I have marked the Support team’s answer as Best Answer.

Thank you for all of your support. Have a nice day ! ?

Problem with website detection

Recommended Posts

Wesly.Zhang

Apal

Apal

Wesly.Zhang

Apal

Wesly.Zhang

Apal

Apal

Apal

Apal

Apal

Flood and Flood's wife

KATE SARRATT

Berny

Wesly.Zhang

Apal

Apal

Apal

Wesly.Zhang

Apal

Forum

Products

Support

Personal Account