Favicon.ico infected

[antler]

2X2 Hosts sent me a message today. message follows:
      favicon.ico    Blocked: http://www.nwhunttalk.com/favicon.ico (analysis using the database of malicious URLs)

How can a favicon.ico become infected and how can I fix it?

[Colin]

Will you please provide a link to your site?

[ApplianceJunk]

Wouldn't the site be http://www.nwhunttalk.com if the fav icon is  http://www.nwhunttalk.com/favicon.ico

[Colin]

No and that is the issue. It is linking to a possibly malicious external site to pull the favicon from.

[Colin]

Unless his host has detected his site as a malicious site. If so LOL.

[antler]

it may be getting it from http://wfwforum,org

my host had me clone http://www.nwhunttalk.com from the above

[Colin]

I am afraid I don't understand. Which one of those sites is actually yours?

[antler]

both sites are mine. I wanted http://www.nwhunttalk.com to be just like http://wfwforum.org. Bluehost had me copy files from

http://wfwforum.org to http://www.nwhunttalk.com. I was not using the .org but didn't want to go thru re-installing the entire site and adding all the mods again.   Anyway, it is what it is now. It still puzzles me how an icon can get infected.

[MrPhil]

I don't think they found the icon itself to be infected, but rather it's coming from a blacklisted site. Is your favicon on your site, and being referred to locally (if you have a <link> to it rather than using the default /favicon.ico)? Or is a shortcut icon <link> pulling it in from some other site that might be blacklisted?

[Storman™]

This sometimes occurs when someone has inserted a call to a favicon file which isn't there. Subsequently the site quite correctly responds with a 404 error code and displays a custom 404 error page. Only problem is that the 404 html page has been doctored with an extra line of code that has a malicious link inserted. Essentially no actual favicon file is involved in the process which makes it confusing.

You should check the folder permissions in the root of your site, the custom 404 pages, plus also check the htaccess file for possible redirects. Also change your root and ftp passwords.

I'm not saying this is the definitely the reason but the above is a possibility, so worth checking out.