Author Topic: Mi pagina web informa que hay un virus/ www.revistamidinero.com.do  (Read 1900 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Mi pagina web informa que hay un virus/ www.revistamidinero.com.do
« on: September 05, 2016, 10:28:24 PM »
Buenas tardes,
Les escribo con urgencia y preocupación. Soy propietaria de la pagina www.revistamidinero.com.do y a la vez soy usuaria de Avast, cada vez que abro la pagina y todos los seguidores de mi blog nos notifica que tiene virus y no m permite acceso por ser  maliciosa. Hemos realizado las labores pertinenetes y nuestra pagina luego de varios scanners no presentamos ningún tipo de contenido malicioso. Solicitamos formalmente revisar dicha situación ya que nuestros servicios y trafico se están viendo afectados por dicho mensaje.

Quedamos a la espera de sus comentarios,

Pamela Pichardo/ Republica Dominicana

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37534
  • Not a avast user
Re: Mi pagina web informa que hay un virus/ www.revistamidinero.com.do
« Reply #1 on: September 05, 2016, 10:40:07 PM »

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Mi pagina web informa que hay un virus/ www.revistamidinero.com.do
« Reply #2 on: September 05, 2016, 10:42:44 PM »
URL:Mal = IP and/or domain is blacklisted

Outdated software :
https://sitecheck.sucuri.net/results/www.revistamidinero.com.do

Insecure library used :
http://retire.insecurity.today/#!/scan/554e107bb733d4dcd7cc639d0fe6dd15c39cdff5639fbf335f0d6735eb11d9d1

Really bad IP history :
https://www.virustotal.com/en/ip-address/107.180.27.178/information/

Blacklisting on that ASN :
http://urlquery.net/report.php?id=1473107872190

The problem is likely a IP block due to the problems on that ASN.

Advise : Stay away from shared hosting on GoDaddy.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33905
  • malware fighter
Re: Mi pagina web informa que hay un virus/ www.revistamidinero.com.do
« Reply #3 on: September 05, 2016, 10:55:51 PM »
Site probably blocked because of PHISHING of other domains on same IP: https://cymon.io/107.180.27.178
and https://www.threatcrowd.org/ip.php?ip=107.180.27.178
Code to be retired: -http://www.revistamidinero.com.do
Detected libraries:
jquery-migrate - 1.4.1 : -http://revistamidinero.com.do/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
jquery - 1.12.4 : (active1) -http://revistamidinero.com.do/wp-includes/js/jquery/jquery.js?ver=1.12.4
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
(active) - the library was also found to be active by running code
1 vulnerable library detected

CMS Outdated: Outdated WordPress Found   Security Updates   WordPress Under 4.6

Warrning Directory Indexing Enabled
In the test we attempted to list the directory contents of the uploads and plugins folders to determine if Directory Indexing is enabled. This is an information leakage vulnerability that can reveal sensitive information regarding your site configuration or content.

/wp-content/uploads/ enabled
/wp-content/plugins/ disabled
Directory indexing was tested on the /wp-content/uploads/ and /wp-content/plugins/ directores. Note that other directories may have this web server feature enabled, so ensure you check other folders in your installation. It is good practice to ensure directory indexing is disabled for your full WordPress installation either through the web server configuration or .htaccess.

Also consider souces and sinks here: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fwww.revistamidinero.com.do

Security here = 0 -> https://webcookies.org/cookies/www.revistamidinero.com.do/2999347

3 times F-Status: https://observatory.mozilla.org/analyze.html?host=www.revistamidinero.com.do

You could ask for an exclusion of that general IP block, but that to decide is only for Avast Team Members, as we are just volunteers with experience and relevant knowledge. So wait for one to give the final verdict.

polonus (volunteer website security analyst and website error-hunter)
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1038
Re: Mi pagina web informa que hay un virus/ www.revistamidinero.com.do
« Reply #4 on: September 06, 2016, 04:30:49 PM »
Yup, it was indeed blocked because of many malicious domains on the same IP. I would suggest changing your host.
I unblocked it now ;)