Author Topic: False Positive URL:Mal  (Read 17126 times)

0 Members and 1 Guest are viewing this topic.



CharleyO

  • Guest
Re: False Positive URL:Mal
« Reply #2 on: January 16, 2011, 07:44:44 AM »
***

http://www.UnmaskParasites.com/security-report/?page=norma-market.ru


Suspicious Inline Scripts :

Long suspicious script

Quote
document.write("< a href='hXXp://www.liveinternet.ru/click' target=_blank>< img src='//counter.yadr...


***

Jonhs

  • Guest
Re: False Positive URL:Mal
« Reply #3 on: January 16, 2011, 12:34:12 PM »
Long suspicious script
This is liveinternet.ru counter. Same FP reaction on some sites where it is installed.

from norma-market.ru
<!--LiveInternet counter-->
<script type="text/javascript">document.write("<a href='http://www.liveinternet.ru/click' target=_blank><img src='//counter.yadro.ru/hit?t14.6;r" + escape(document.referrer) + ((typeof(screen)=="undefined")?"":";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth?screen.colorDepth:screen.pixelDepth)) + ";u" + escape(document.URL) + ";" + Math.random() + "' border=0 width=88 height=31 alt='' title='LiveInternet: показано число просмотров за 24 часа, посетителей за 24 часа и за сегодня'><\/a>")</script><!--/LiveInternet-->

new code from liveinternet.ru
<!--LiveInternet counter-->
<script type="text/javascript">document.write("<a href='http://www.liveinternet.ru/click' target=_blank><img src='//counter.yadro.ru/hit?t14.6;r" + escape(document.referrer) + ((typeof(screen)=="undefined")?"":";s"+screen.width+"*"+screen.height+"*"+(screen.colorDepth?screen.colorDepth:screen.pixelDepth)) + ";u" + escape(document.URL) + ";" + Math.random() + "' border=0 width=88 height=31 alt='' title='LiveInternet: показано число просмотров за 24 часа, посетителей за 24 часа и за сегодня'><\/a>")</script><!--/LiveInternet-->

http://www.finjan.com/Content.aspx?id=1190&url=http%3A%2F%2Fnorma-market.ru%2F&state=unsafe&category=Other&reason=Potential%20adware%20behavior%20was%20detected%20on%20this%20page&more=
Possible that reason is same.
« Last Edit: January 16, 2011, 02:38:55 PM by Jonhs »

Offline Sirmer

  • Avast team
  • Sr. Member
  • *
  • Posts: 324
Re: False Positive URL:Mal
« Reply #4 on: January 17, 2011, 11:28:31 AM »
Hello,
this false positive wasn't caused by liveinternet.ru. It was false positive in our black list.
Regards

Jonhs

  • Guest
Re: False Positive URL:Mal
« Reply #5 on: January 17, 2011, 11:41:55 AM »
Thank you :)

Offline Simion

  • Advanced Poster
  • **
  • Posts: 976
Re: False Positive URL:Mal
« Reply #6 on: January 18, 2011, 01:26:46 AM »
Thank you :)

Glad you got it resolved with Avast, anyway. :)

m00nbl00d

  • Guest
Re: False Positive URL:Mal
« Reply #7 on: January 18, 2011, 02:30:24 AM »
-http://hosts-file.net/?s=liveinternet.ru and -http://www.urlvoid.com/scan/liveinternet.ru

-http://www.urlvoid.com/scan/norma-market.ru
« Last Edit: January 18, 2011, 02:32:00 AM by m00nbl00d »

r0b1n

  • Guest

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: False Positive URL:Mal
« Reply #9 on: February 08, 2011, 05:26:14 PM »
Please help. What should I do?  ???

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles
asyn
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

r0b1n

  • Guest
Re: False Positive URL:Mal
« Reply #10 on: February 08, 2011, 05:36:36 PM »

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles
asyn

Oh, thank you, Asyn. I'll try it!  :)

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: False Positive URL:Mal
« Reply #11 on: February 08, 2011, 05:51:36 PM »
Oh, thank you, Asyn. I'll try it!  :)

You're welcome..!
asyn
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline Sirmer

  • Avast team
  • Sr. Member
  • *
  • Posts: 324
Re: False Positive URL:Mal
« Reply #12 on: February 09, 2011, 12:48:01 PM »
Hello,
r0b1n.org.ua should be fixed in current VPS. But it wasn't a same case, because norma-market was a false positive in our web shield but r0b1n.org.ua was really infected and now it's clean.
Regards

Petrovich123

  • Guest
blocking the site www.fonariki.skrepka.pl.ua
« Reply #13 on: September 18, 2011, 08:01:34 PM »
Developers AVAST help, please. Your antivirus is blocking the site www.fonariki.skrepka.pl.ua. You can check for the black list.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: blocking the site www.fonariki.skrepka.pl.ua
« Reply #14 on: September 18, 2011, 10:13:14 PM »
Developers AVAST help, please. Your antivirus is blocking the site wxw.fonariki.skrepka.pl.ua. You can check for the black list.

Please open a new topic.
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0