Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: a1batman on January 21, 2009, 10:51:28 PM

Title: HTML:Allaple-A [Wrm] mallware allert when connecting to a certain website
Post by: a1batman on January 21, 2009, 10:51:28 PM

Recently I have started to get an avast warning when I try to connect to the following link
http://www.mcsl.demon.co.uk/pages/leaguetables.htm I never used to get problem before using avast so I emailed the owner of this link and he said his virus software was unable to find any virus/mallware and that other users were not experiencing this problem.
The alert message is asking me to abort the connection but if I close this error window I get another avast warning window giving me options as follows:_
 Move/Rename..  Delete....  Repair...  Move to Chest
Recommended action: Move to Chest
Also a No action option is available but I'm not sure if it will be safe to try this or not.

What is the report as false positive for. Their is no help on this option.

Regards from a1batman

Title: Re: HTML:Allaple-A [Wrm] mallware allert when connecting to a certain website
Post by: Lisandro on January 21, 2009, 11:13:40 PM

Most probably the webshield was hacked and an encrypted script was added at the end of the webpage...
Dr. Web found nothing on that page. But I trust avast...

Title: Re: HTML:Allaple-A [Wrm] mallware allert when connecting to a certain website
Post by: DavidR on January 22, 2009, 12:21:56 AM

It looks like a good detection, although I didn't see anything obvious on the page, I uploaded it to virustotal and 11 of 39 scanners though it worthy of an alert.

http://www.virustotal.com/analisis/e5242e41db94e3b111d874872b772876 (http://www.virustotal.com/analisis/e5242e41db94e3b111d874872b772876)

So it could well be that the page has been hacked.

There is an <object> tag at the start of the page that could be importing dynamic content.

Title: Re: HTML:Allaple-A [Wrm] mallware allert when connecting to a certain website
Post by: polonus on January 22, 2009, 12:45:44 AM

Hi DavidR,

Here I get an all safe: http://safeweb.norton.com/report/show?url=http%3A%2F%2Fwww.mcsl.demon.co.uk%2Fpages%2Fleaguetables.htm&x=12&y=4
But that does not say much about if this is real time, so I would be cautious,
and LinkScanner Online did not find any problems either:
Congratulations! LinkScanner Online did not find any exploits.

polonus

Title: Re: HTML:Allaple-A [Wrm] mallware allert when connecting to a certain website
Post by: DavidR on January 22, 2009, 01:46:17 AM

There are a lot of generic detections on the VT results, but it is probably worth further analysis, so I have sent the sample to avast.