Author Topic: Avast says that one of my sites has a virus! its not true  (Read 4872 times)

0 Members and 1 Guest are viewing this topic.

titodj

  • Guest
Avast says that one of my sites has a virus! its not true
« on: December 04, 2010, 01:16:09 AM »
I have check and recheck and cant find anything wrong, but AVAST still reports some kind of infection, but none of the users with other antivirus report any problems,  what should I do.?

This is one of the addresses the users are reporting.
 
http://miespaciovirtual.com/pagos/Mex/


Thanks...

Offline schmidthouse

  • VIRUS FREE A Long Time
  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7118
  • When you think you know, Think Again
Re: Avast says that one of my sites has a virus! its not true
« Reply #1 on: December 04, 2010, 01:37:59 AM »
I have check and recheck and cant find anything wrong, but AVAST still reports some kind of infection, but none of the users with other antivirus report any problems,  what should I do.?

This is one of the addresses the users are reporting.
 
http://miespaciovirtual.com/pagos/Mex/
Thanks...

Hi titodj; Have you done a boot-time scan...just curious. I so anything detected...Usaully with boot-time scan the scan halts when a 'bad boy' is hit and then will ask you with some choices what you want to do.  Any identification or file/name produced by Avast?
***HP ENVY 15K LT W10 Pro 21H2 64Bit/250GB SSD/16GB Ram/ADU v.22.2b/VS/SANDBOXIE-plus/MailWasherPRO
**HP Compaq 8510p LT W10 Pro 21H2 64Bit/1TB HD/8GB Ram/ADU v.22.2b/VS/SANDBOXIE/HotSpot Shield
 Avast Mobile Security (Android)
LAYERED SECURITY SOFTWARE

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37190
Re: Avast says that one of my sites has a virus! its not true
« Reply #2 on: December 04, 2010, 01:48:17 AM »
a boot time scan will not detect a malicious web site. Boot time scan is something you use when the normal scan have found an infection but can not remove it


VirusTotal - URLscan - Phishing site
http://www.virustotal.com/url-scan/report.html?id=c6675b06e10f7a76ce95161b35bb9f35-1291419639

NoVirusThanks - URLscan - INFECTED
http://vscan.novirusthanks.org/analysis/b26eeb8e3791c21db91b89a7d681bb55/aW5kZXg=/

URLVoid - SUSPICIOUS

« Last Edit: December 04, 2010, 01:50:08 AM by Pondus »

Hawk

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #3 on: December 04, 2010, 02:01:00 AM »
Yeah it is infected. It has some kind of obfuscated script injected in the main index.html file

Avast is always good with this kind of attack ;D

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 86832
  • No support PMs thanks
Re: Avast says that one of my sites has a virus! its not true
« Reply #4 on: December 04, 2010, 03:00:51 AM »
Looks like your previous problem is back, when you though it a false positive then also.

http://forum.avast.com/index.php?topic=61950.0
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

titodj

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #5 on: December 04, 2010, 07:39:49 AM »
Thank you all....  But...

With all due respect, does anyone even bother to look at the source of the URL we're talking about??

http://miespaciovirtual.com/pagos/Mex/

I might be wrong but I cant see where a malicious code could be hiding there...
BTW when I put that URL in Virus Total, it comes back clean??

I have users there all the time with all kinds of antivirus, and only AVAST gives them a positive,  my problem is I don't know why?

The two URL's  I'm interested in, because are the ones people complains, are

http://miespaciovirtual.com/pagos/Mex/
http://miespaciovirtual.com/pagos/

And as I said, I cant find anything wrong in them...

Thanks....

CharleyO

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #6 on: December 04, 2010, 08:01:37 AM »
***

I tried both links and I get :

"Connection closed by remote server"


***

titodj

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #7 on: December 04, 2010, 08:05:08 AM »
Weird....

I can see them fine, but, it is the time when the server has more load, so I guess its possible the server was busy at the time...

Hawk

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #8 on: December 04, 2010, 11:42:34 AM »
The problem is that the main page is infected hxxp://miespaciovirtual.com/ and avast network shields blocks that website and all websites containing *miespaciovirtual.com* in them.

the other pages http://miespaciovirtual.com/pagos/Mex/ and http://miespaciovirtual.com/pagos/ don't seem to be infected.

titodj

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #9 on: December 04, 2010, 05:09:29 PM »
The problem is that the main page is infected hxxp://miespaciovirtual.com/ and avast network shields blocks that website and all websites containing *miespaciovirtual.com* in them.

the other pages http://miespaciovirtual.com/pagos/Mex/ and http://miespaciovirtual.com/pagos/ don't seem to be infected.

Last night I did find a weird code in the "root" of the website, and was removed, but the two URL's in question are ALWAYS reached by a direct referrer and there are no links between the root and this two URL's, in other words, people trying to get to those two URL's never visit another part of the website.

That's why I didn't even look at the "root" of the website, anyway, if I'm understanding this right, AVAST  is not really scanning the pages in real time, but relaying in some kind of database??
Or how is that you can get a positive in a clean page if another page in the site (with no internal links between) is infected?

Finally and more important what should to get rid of those false positives that AVAST is giving to my users??

Ritchi

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #10 on: December 05, 2010, 01:52:59 AM »
False positive, I am currently trying out products like avast and bitdefender, I can say this is a false positive. I entered this page and antivirus pro bitdenfender I have not detected anything his shield, malwarebytes' antimalware and also not use comodo firewall. So I guess I have a protective false dared to enter and nothing happened.

a screenshot


titodj

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #11 on: December 06, 2010, 06:46:58 AM »
So ???

What I should do??

AVAST keep's giving my users a FALSE positive...


titodj

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #12 on: December 06, 2010, 07:33:07 AM »
Quote
agree with Pondus & Virus total..you donot make anything on the website and you ask for donation? Shocked

I can ask for a donation just because my face is pretty...  and the users decide if they do or don't donate...

The problem here is that AVAST is reporting an infection that does NOT exist!!!

its really funny to me that in a forum hosted by an anti virus product every one is relaying in information from other websites.

I have yet to see anyone pointing to an "infection" on the code of my website...


 

File Info

Report date: 2010-12-06 07:50:35 (GMT 1)
File name: miespaciovirtual-com
File size: 5073 bytes
MD5 Hash: d2ee18c70c6bc4dcf3778cf6f0a9697e
SHA1 Hash: a0ae82f4e72f4edb2b761c71e5afe80d958bd43d
Detection rate: 0 on 16 (0%)
Status: CLEAN

Detections

a-squared -
Avast -
AVG -
Avira AntiVir -
BitDefender -
ClamAV -
Comodo -
Dr.Web -
F-PROT6 -
Ikarus T3 -
Kaspersky -
NOD32 -
Panda -
TrendMicro -
VBA32 -
VirusBuster -

Scan report generated by
NoVirusThanks.org
« Last Edit: December 06, 2010, 07:52:05 AM by titodj »

alenka

  • Guest
Re: Avast says that one of my sites has a virus! its not true
« Reply #13 on: December 06, 2010, 01:09:57 PM »
Hello,

the reason your site is still blocked is that there were several problems in the past (actually it is flagged as malicious since 2009). And as this forum thread proves, your site has still security issues (talking about that malicious code on your homepage. Looks like someone has injected that code there and deleting it does not solve it - or just for a short time). It looks like you have a security problems - maybe your password has been stolen?

Alena Varkockova