Author Topic: HTML:Allaple-A [Wrm] mallware allert when connecting to a certain website  (Read 5910 times)

0 Members and 1 Guest are viewing this topic.

a1batman

  • Guest
Recently I have started to get an avast warning when I try to connect to the following link
http://www.mcsl.demon.co.uk/pages/leaguetables.htm I never used to get problem before using avast so I emailed the owner of this link and he said his virus software was unable to find any virus/mallware and that other users were not experiencing this problem.
The alert message is asking me to abort the connection but if I close this error window I get another avast warning window giving me options as follows:_
 Move/Rename..  Delete....  Repair...  Move to Chest
Recommended action: Move to Chest
Also a No action option is available but I'm not sure if it will be safe to try this or not.

What is the report as false positive for. Their is no help on this option.

Regards from a1batman

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Most probably the webshield was hacked and an encrypted script was added at the end of the webpage...
Dr. Web found nothing on that page. But I trust avast...
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89029
  • No support PMs thanks
It looks like a good detection, although I didn't see anything obvious on the page, I uploaded it to virustotal and 11 of 39 scanners though it worthy of an alert.

http://www.virustotal.com/analisis/e5242e41db94e3b111d874872b772876

So it could well be that the page has been hacked.

There is an <object> tag at the start of the page that could be importing dynamic content.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33897
  • malware fighter
Hi DavidR,

Here I get an all safe: http://safeweb.norton.com/report/show?url=http%3A%2F%2Fwww.mcsl.demon.co.uk%2Fpages%2Fleaguetables.htm&x=12&y=4
But that does not say much about if this is real time, so I would be cautious,
and LinkScanner Online did not find any problems either:
Congratulations! LinkScanner Online did not find any exploits.

polonus
« Last Edit: January 22, 2009, 12:48:30 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89029
  • No support PMs thanks
There are a lot of generic detections on the VT results, but it is probably worth further analysis, so I have sent the sample to avast.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security