Avast free detects malicious virus and it is clean

[cpm]

my url is wxw.cristobalpenalva.com and Avast freecdetects malicious virus.
Can you help me, please?

Thanks

[Pondus]

yea....they always say that......completely clean...avast is wrong.   


sucuri
http://sitecheck.sucuri.net/results/www.cristobalpenalva.com/
http://labs.sucuri.net/db/malware/malware-entry-mwiframehd5


Zulu analyzer
http://zulu.zscaler.com/submission/show/077fe1b859f9b765c9d14d0dac99ede2-1340965325

urlQuery
http://urlquery.net/report.php?id=78403


url scan
http://vscan.novirusthanks.org/analysis/029a7f2a8e84252b52055aea734e73f8/aW5kZXg=/



so.....still think it is clean.   

[Asyn]

yea....they always say that......completely clean...avast is wrong.   

Doesn't look clean at all...

@cpm: Please make your link unclickable..!!! Example: wxw.cristobalpenalva.com

[cpm]

ok,
I will check my web.
Thanks!

[Pondus]

virustotal
https://www.virustotal.com/file/d34d48e9d77cd4e3e99a754fc7092f9f312641e0c31d4d7f8429aa258044d56b/analysis/1340966881/

[true indian]

virustotal
https://www.virustotal.com/file/d34d48e9d77cd4e3e99a754fc7092f9f312641e0c31d4d7f8429aa258044d56b/analysis/1340966881/

Avast! doesnt get it on VT...looks like VT is behind on VPS updates. 

[Asyn]

ok,
I will check my web.
Thanks!

Good idea..!!
You're welcome.

[DavidR]

virustotal
https://www.virustotal.com/file/d34d48e9d77cd4e3e99a754fc7092f9f312641e0c31d4d7f8429aa258044d56b/analysis/1340966881/

Avast! doesnt get it on VT...looks like VT is behind on VPS updates. 

It rather depends as this is a web shield detection and that may not be detected in a standard on-demand scan of VT depending on the web shield alert.

If you are just throwing a URL at VT to scan there are numerous times when this doesn't return anything.

[mchain]

yea....they always say that......completely clean...avast is wrong.   


sucuri
http://sitecheck.sucuri.net/results/www.cristobalpenalva.com/
http://labs.sucuri.net/db/malware/malware-entry-mwiframehd5


Zulu analyzer
http://zulu.zscaler.com/submission/show/077fe1b859f9b765c9d14d0dac99ede2-1340965325

urlQuery
http://urlquery.net/report.php?id=78403


url scan
http://vscan.novirusthanks.org/analysis/029a7f2a8e84252b52055aea734e73f8/aW5kZXg=/



so.....still think it is clean.   

Reported as malicious link here:  hxxp://labs.sucuri.net/db/malware/malware-entry-mwiframehd5

See attached below. 

EDIT:  This should not happen with a securi link?

[DavidR]

Wrong, it happens with many analysis sites as they can display the content/example and avast alerts on it.

This seems to be the case here, see image extract of page source and VT results on that page, https://www.virustotal.com/file/85075e1adf13627938937f954782e2710afe8fa70cc64539ceef744cff65c288/analysis/1340988268/.

[mchain]

Wrong, it happens with many analysis sites as they can display the content/example and avast alerts on it.

This seems to be the case here, see image extract of page source and VT results on that page, https://www.virustotal.com/file/85075e1adf13627938937f954782e2710afe8fa70cc64539ceef744cff65c288/analysis/1340988268/.

@DavidR,

Thanks for that.  Apparently the VT link indicates this is actually a BlackHole Exploit Kit or a part of it, anyway.     For the unwary and unsavvy, this would be the piece that takes the cake. 

Thanks for the link and thanks for explaining how Avast! would alert on content displayed at securi or other url scanning sites.

Learn something new every day.  BTW version 7.0.1451 is installed now, so....

[DavidR]

You're welcome.