Web Shield FP? -> Solved

[mbrowne]

Avast Free v8 Web Shield has recently begun alerting on www.sweetmarias.com with:

7/30/2014 1:14:43 PM  http://www.sweetmarias.com/store/|>{gzip} [L] JS:ScriptIP-inf [Trj] (0)

I've run the page through Securi SiteCheck and virustotal and it comes up clean.  Defs version 140729-0

Thanks for any help.

[Eddy]

You are using a real old avast version.
Update to the newest one then check again.

[Pondus]

VirusTotal
https://www.virustotal.com/en/file/c1a15a37b443daf5c546cb11edf0b452b69138d9d87e181788120ca736c5c6bd/analysis/1406754318/

[Tondah]

Hello, there is javascript function called "timedCount()" that does not seems too legit.
This function collects informations from shipping/registration form and send them to internet every 40 miliseconds.

[mbrowne]

Hello, there is javascript function called "timedCount()" that does not seems too legit.
This function collects informations from shipping/registration form and send them to internet every 40 miliseconds.

Thanks for checking that.  When I made the site owner aware of the alert 2 days ago, he said he was referring it to his "IT guy." 

And I'm still getting the alert after updating to Avast v9.

[mbrowne]

Thanks for the help Tondah.  The site has been fixed and the owner tight-lipped as to whether is was sloppy code or injection.  Nothing but Avast found it.