Strange Avast pop-up warning

[DavidR]

I'm not surprised as there is a script on the forums home page that accesses the suspect site, my image Reply #11 (also image2 this post) and your first image both have the IP address that avast is alerting on.

So it doesn't seem to matter if you log on or just visit the forums home page those scripts would be loaded, with firefox and NoScript this doesn't happen as all scripts are blocked unless you specifically allow them.

If I visit the forums home page vbaexpress.com/forum/, without allowing scripts there is only one script blocked that of vbaexpress see image1, if I temporarily allow vbaexpress then there are two further scripts that want to run, see image2 and it is one of those that is for the blocked site.

So in short there really isn't anything else I can say this really is now down to the Admins/webmaster to investigate why this happens and do something about it.

[stanl]

I cannot thank you enough.  I had already forwarded your information via printscreen to the forum. I am assuming Awil already had that site pegged as 'malicious'... if this works out in the long run we all benefit.

Stan

[DavidR]

You're welcome.

Well the IP address causing the issues is in a list of blacklisted addresses in the Network Shield to stop people reaching known malware sites, your first image shows it is the Network Shield alerting. That site IP has cropped up in the avast forums (a search will find it) and if I remember rightly it is a particularly nasty infection.

On my images you will see a Red IP address at the bottom, that is the vbaexpress site, so it helps by confirming I was at the vbaexpress site (and not some phishing site).

Also on the forums home page (I didn't mention it) there there is a <Script tag that has a huge chunk of obfuscated javascript, I honestly can't see a legitimate purpose for this, javascript is a plain language and when I see that I wonder what is it that they are trying to hide. Now that according to the script title is some Yahoo counter which I find hard to believe, so it could be that that script is the source of the problem, I don't have enough experience to say.

[stanl]

just an FYI: another user just posted that a malicious redirect might be responsible for the slowdown he and other users have experienced in the past week.  Stan

[DavidR]

Not unusual as if the redirect is successful you could be infected and what ever is going on as a result of that could well slow the system.

[stanl]

Well, problem fixed. Site works fine w/out pop-up now.

[DavidR]

Looks like the problem was on the site as the two mysterious scripts with the IP addresses have now disappeared, see image.

Did vbaexpress say that they fixed the problem or are they keeping quiet

That big chunk of obfuscated javascript I mentioned in Reply #17 has now gone, could it be that a scripting help site got hacked