Avast WEBforum

Other => Viruses and worms => Topic started by: sunsetlover on December 20, 2015, 03:30:31 PM

Title: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: sunsetlover on December 20, 2015, 03:30:31 PM

I erroneously posted this on the other forum also. Apologies.

The infection is: HTML:Iframe-inf

What is strange is that it's doing this starting today. I have used this site for the past 2-3 years with no warning, it's a speed test site for within China.

Btw, I just scanned it with urlvoid and it found no threats.

Thanks!

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: Pondus on December 20, 2015, 04:45:33 PM

Quote

What is strange is that it's doing this starting today. I have used this site for the past 2-3 years with no warning, it's a speed test site for within China.

There are no 100% safe websites, a site that is clean today can be hacked and infected tomorrow

Post screenshot of avast popup warning

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: polonus on December 20, 2015, 08:57:33 PM

Yep, Pondus, site has outdated server software: -http://www.speedtest.cn/
What is being flagged here: List of iframes included
-http://web5529324.newusa.badudns.cc/SpeedTest/index.php?tp_id=28
-http://a13206408829.HHXJ02.hhgoip.com/speedtestsvr/SpeedTest.html
as  HTML:Iframe-inf

polonus (volunteer website security analyst and website error-hunter)

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: HonzaZ on December 22, 2015, 09:12:17 PM

We block it because it as an iframe pointing to 026idc.com, which we block.

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: sunsetlover on December 23, 2015, 05:11:11 AM

Thank you all!

I just did a search for 026idc.com and it looks like it's a hosting and cloud hosting site in China and HK.

Btw, for serious scanning I always prefer to do it in safe mode. Do you guys agree?

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: Pondus on December 23, 2015, 08:04:34 AM

Quote

Btw, for serious scanning I always prefer to do it in safe mode. Do you guys agree?

No

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: HonzaZ on December 28, 2015, 09:55:45 AM

I unblocked 026idc.com now, it really does not seem malicious.

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: polonus on December 28, 2015, 12:09:58 PM

Hi HonzaZ,

You unblocked http://026idc.com/ but has http://www.026idc.com/ still blocked as URL:Mal.
Or do I have to update my definitions?

polonus

Title: Re: As of today Avast is blocking www.speedtest.cn as it finds an infection
Post by: HonzaZ on December 28, 2015, 12:58:17 PM

Yup, update. If it doesn't help, then disable/enable shields ;).