[FR] Avast detect some virus on my website.

[Sparkdaemon]

I've scan every pages, And, java aren't enabled...

[Pondus]

When entering the website i get a IP block from MalwareBytes PRO
IP: 217.23.14.152 Blocked

IP listed at hpHost
http://hosts-file.net/default.asp?s=217.23.14.152

[Sparkdaemon]

Hi,
I have 2 screenshot from my members.
http://www.sparkdaemon.fr/av1.jpg
http://www.sparkdaemon.fr/av2.bmp

The blocked page is the externals vars.
He contains :

Code: [Select]

badge_name_FR018=Animateur
badge_desc_FR018=Anime les jeux sponsos
badge_name_FR019=Roller et manette
badge_desc_FR019=Gagne aux jeux sponsos
badge_name_FR020=Renne et sapin
badge_desc_FR020= Gagne aux jeux sponsos
badge_name_FR021=W.C. et canard
badge_desc_FR021=Gagne aux jeux sponsos
badge_name_FR022=Tabouret et caisse
badge_desc_FR022=Gagne aux jeux sponsos
furni_env_grass_name=Herbe
furni_env_grass_desc=Toujours plus verte ailleurs…
furni_hweeen09_floor_name=Parquet
furni_hween09_floor_desc=Les lattes grincent ! :o
wallitem_hween09_curt_name=Rideaux fantomes
wallitem_hween09_curt_desc=Idéal pour vos manoirs hantés !
wallitem_hween09_wall1_name=Pan de mur de manoir
wallitem_hween09_wall1_desc=Il sent le moisi.
wallitem_hween09_crnr1_name=Angle de manoir
wallitem_hween09_crnr1_desc=Il sent le moisi.
furni_country_rain_name=Pluie
furni_country_rain_desc=Sort ton parapluie
furni_country_scarecrow_name=Epouvantail
furni_country_scarecrow_desc=Avant, il était vivant.
wallitem_country_wall_name=Porte campagnarde
wallitem_country_wall_desc=Ferme-là !
furni_eco_mush2_name=Amanite tue-mouches
furni_eco_mush2_desc=Toxique !
furni_ads_grefusa_cactus_name=Cactus a chapeau
furni_ads_grefusa_cactus_desc=Il s’apelle Henri !
furni_env_tree4_name=Arbre des 4 sasions
furni_env_tree4_desc=Renouvèle l’oxygène !
wallitem_party_lights_name=Spots
walltiem_party_lights_desc=On dirait de la neige ! :o
furni_hween09_chair_name=Chaise majestueuse
furni_hween09_chair_desc=On se sens majestueux
furni_party_lantern_name=Lanterne chinoise
furni_party_lantern_desc=Douce lumière pour éclairer douce nuits
furni_country_well_name=Puits
furni_country_well_desc=Des voix en proviennent ! :o
furni_bumps_lights_name=Feu rouge
furni_bumps_lights_desc=On attend qu’il soit vert !
badge_name_GFS=Coeurs multicolores
badge_desc_GFS=Effet arc-en-ciel garanti
badge_name_GUI=Carte coeur |
badge_desc_GUI=Pioche l'As !

Why AVAST block this page?

[spg SCOTT]

avast is alerting on the first script in that file, not really sure on the detection. Can't seem to get virustotal to work...

Jotti: http://virusscan.jotti.org/en-GB/scanresult/09f7ed49fd1cafb3cb55d37944926c0fb9b7dc57 <-- text file containing that script only.

[Sparkdaemon]

If i understand.. The problem come directly by the pubs one the page..

Look,

With ads :
http://virusscan.jotti.org/en-GB/scanresult/1b0272a30b0deac627945ca514e79e491daa2df4
Whisout ads :
http://virusscan.jotti.org/en-GB/scanresult/fe992f5e38f4c55d7a968fc97c9b3077750cd9df

Thanks for ur help... ^^

[spg SCOTT]

I am not exactly sure about it to be honest. All I can tell is that the script is repeated, but the first one has an added line (var d....) this added line in combination with the script seem to cause an alert...

I have reported the thread and asked for one of the virus analysts to take a look, so hopefully they can shed some more light on the subject.

Scott

[Sparkdaemon]

Thank you !