Can a website detect malware or virus present on device / PC?

Question

I just got off the phone with an investment firm where I have an account. About a month ago, they blocked online access to my account due to "malware or a virus" found on my PC or device. Since we had been overseas for most of that month, and according to their logs the time when the "virus or malware" was discovered was roughly 1pm on March 29th (and we were already out of the country), that means that the number of devices we could have logged on with is reduced down to only 4 (two Android phones, an Android table, and an iPad). The time stamp would have been roughly 1am the following day in the country we were visiting, about 1-2 days after we arrived. After talking with the customer service manager for some length of time, there has been no activity in my account, other than payroll deposits as expected, so I don't think anything untoward has occurred.

They refused to grant me access to my account until I'd had my devices / PC "professionally cleaned". I have no idea how they'd be able to know I'd done this, besides I'm a computer professional, and I'm reasonably certain none of my devices are infected with anything. Once I've done this, they will change passwords and usernames, etc. to allow me access to the account.

What I suspect actually happened was me trying unsuccessfully to log onto the account from my tablet (I vaguely remember something like this happening right after we got there, but didn't think much of it). I probably tried too many times and the account got blocked. Since I was trying from an out of the US IP address, this made it suspicious. That's my guess.

My actual question is, is it possible for a given website to be able to detect that the log on attempt is occurring from a device that has a virus or malware on it? I don't believe it's possible for them to sniff my devices, but I figured you guys would know better than me.

Answer 1

It is unlikely, but that also depends on what they might classify as a virus/malware. To answer this, one needs to consider what types of access a website has to a client that is visiting it.

JavaScript can be used to probe a bit about the system:

• Your coarse location
• Installed extensions
• Device info
• Information about services on your local machine or network (port scanning)

Most of these aren't very likely to provide indication of any malicious software being present. It is more likely that they detected a suspicious login attempt from a device (maybe the device appeared to be in a different location) and somehow assumed one of yours was compromised. Seems a bit overkill.

Answer 2

While you probably hope for a solid „nope“, it’s not not easy.

First off: I think account lock out as you described is what I would suspect as well, yet there might be more to it than you trying to log in from a non-US IP. But more on that below.

Secondly: There are some ways to detect very specific kinds of malware using JavaScript (and much more via Java applets) for example.

Those ways would make it possible to detect some malware; I doubt your bank is using such methods, however.

Albeit an infection might be detectable by a website, I suspect the following:

You connected via a WiFi at your destination, probably. Not only does that probably provide access for more people than you, providers outside the US (the EU, for example) assign different IPs to customers every 24 hours. Now, if someone else - or another customer at another time - has hit a honeypot, the IP would be in databases as compromised (for example, because it partook in a DDoS or sent spam).

If now your log in attempts triggered a check of that IP and your bank has data subscribed from honeypots, they might conclude a infected device.

Answer 3

A website can ask permission to access certain files in your computer system. I know windows has logs and as such specific logs that do contain antivirus scan reports stating "Found: 0 threats or malicious programs/executables etc" or "Found: 5 threats or malicious programs/executables" these logs can be done daily or weekly or everytime you want to scan your system in a windows environment specifically for windows 10. However the structure of windows systems do have the same log files mostly in terms of vulnerability reports starting I think windows Vista or Windows 7 up until current year. The location on windows 10 is C:\Windows\Debug\msert.log

There are also EVENT LOGS these can give insight of whether someone accessed your PC or Device at a certain time and some tell tale signs of an intrusions in your system. You probably already knew about this part of my answer however I just have to point it out. %SystemRoot%\System32\Config folder usually under this path.

With that said if the most recent log file for the Vulnerability scan has some flags or "FOUND : 5 Malicious executables etc" then that could be found by a websites access to your file system and from the logs determine IF your machine currently has malicious programs or executables or is insecure.

Also to add to the accessing of your computers file system you first need to give permission for any of this to take place so when a website says "grant access to file system yes or no" then you can accept or decline. So to answer your question yes a website can access your machine to determine if it possibly could be infected and also currently have a malicious executable.

So to answer the question is it possible for a website to access your machine to determine if the machine is corrupted by viruses, malicious exectuables or programs the answer is yes so long as you give access as most legal and ethical businesses will ask permission to access your device.