False positive for agraphia.net

[nanoer]

Hi all,

I think that Avast Web Shield is throwing a false positive for HTML:script-inf for the website hxxp://agraphia.net It blocks the website and gives you a popup asking you to "Abort Connection"

Not sure how valid proof this is that the site is clean but:
http://www.unmaskparasites.com/security-report/?page=www.agraphia.net

Edit to add Virus Total links:
http://www.virustotal.com/url-scan/report.html?id=b8a401c1e16fe3eb13a6ae82840a4aee-1296531023
http://www.virustotal.com/file-scan/report.html?id=464e69ec89872bd322d53c3de4e7b05909fbb69862ff5bf3532c7f35a0cdf200-1296534632

I think Paretologic URL scan might also be a false positive.

The file scan shows Avast, Avast 5, and GData(which uses Avast and BitDefender I think) are the only ones that find malware on this site.

[DavidR]

The network shield is also blocking the domain now, probably as a result of multiple alerts by the web shield feeding back into the avast! CommunityIQ feature.

I too only got those three results in the VT scan, but for some reason the MD5 hash is different. I had a look at the home page source code and I couldn't see anything obvious.

URLVoid finds three hits Parentlogic as you mentioned, MyWOT and HpHosts, so still a little wriggle room. http://www.urlvoid.com/scan/agraphia.net


- There is a new on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Press (Media), issues.
- If you are reporting an FP, then you get another input field open, click Browse button and enter the web URL for the site you wish to submit for review (network & web shield), etc. I would give a link to this topic also.

[jsejtko]

Hello,

Your domains has been blocked because of malware distributed through it - through exploit located at hxxp://www.agraphia.net/counter/pdf.php -> this looks to be removed now.

Block will be removed in the next vps update, but might occur again, if we would encounter another malicious files on your domain.

Best Regards
J. Sejtko