Avast won´t let me open an Onlinestorelink

[rapanuy]

Hi.

I try to open a link at arktis.de (big dealer, amazon partner, they say their site is clean, other customers have no problems).

The link is found in this website (which is opening):
http://www.arktis.de/widerrufsrecht/

down here:
Bitte benutzen Sie im Falle eines Widerrufs unser ausdruckbares PDF-Rücksendeformular:
h**p://www.
arktis.de/retoure/

The link ...retoure should lead to a fillout form for a *.pdf:

But Avast says:
http://img130.imageshack.us/img130/676/avastd.jpg

I have no problems opening other sites or direct *.pdf files!

Thx
Mike

Win 7 32bit, FF 3.6.16 (IE 8 is not opening either, but no avast popup!)
Edit: link broken

[Hermite15]

can you break the second link in your post? thx.

[spg SCOTT]

This detection would appear to be correct.

While the page redirects to another page, it actually also contains an iframe that doesn't belong.

This iframe is what avast is alerting on.

avast is not the only one to detect this: http://www.virustotal.com/file-scan/report.html?id=a0f0467fa45611ea4d9155e99fa5046f2069e948da5a99eada07a3910ee037cb-1303401707
(script in text file)

[rapanuy]

Thx. I´ll inform arktis.

But whats with me: is it safe to deactivate avast for the one link?
Thx,
Mike

[DavidR]

The short answer, for this link I would say no, what ever it is that you want to connect for isn't worth the risk of your system getting infected.

The iframe that is in that page could have any payload at the other end of the redirection.

Though the bolwiegorodagovorjatda.com is unreachable at present, but that could change and what ever was able to insert that iframe tag in the site could just as easily do it again with another site.

[rapanuy]

Thx alot at all of you - I´ll let them send it by mail 

Mike

[rapanuy]

BTW: where did you find the bolwiegorodagovorjatda.com? Is there any log in avast?
Mike

and, before I open a new question. in the avast ptions - realtime protection - webprotection I read down low:

Last scanned website: http://199.93.61.27/idle/SL4mbD8iO-IGtoXr/1337. (<-- number counting up)

What is this site from. When I open a webpage I the it scanned short in this line, then again above adress.

[DavidR]

Click the second image (to expand it) that Scott posted and you can see the iframe tag and its remote location.

[rapanuy]

Ah, I see. Is there a tool used. I just tried

http://www.internetofficer.com/seo-tool/redirect-check/

entered my iframe adress, that led to the Response:

to Type of redirect: 302 Found

Redirected to: http://www.arktis.de/Arktis-Retourenservice/

If I click that one, it leeds to the site I needed.
Mike

[rapanuy]

Okay, I checked the link with Mazilla, but I guess I´m not good a this.
I clicked "follow redirection" YES (I assumed that its just Mazilla inside), and saw in Mazillas top window the arktis.de sites source code - where I could´t find the posted adress.

Then I tried a second time and clicked NO - and saw this time the link bolwiegorodagovorjatda.com

I guess I shouldn´t have clicked YES before

[spg SCOTT]

Yes, essentially, the iframe is loaded before the redirection is done.

[rapanuy]

Oki, learned here. Is there a special scanner next to avast to see if I infected my pc?

Thx
Mike

[rapanuy]

Hi. No last idea if something was downloaded there within Malzilla?
(Scans with Avast, MS Essentials, Hijack This and Antimalware showed no results).

Thx
Mike

[spg SCOTT]

Malzilla? It just downloads the source of the page, and is cleared on exit. (depending on settings) You can also clear it yourself, if you wish (in settings - download tab)

[rapanuy]

OK, thx. I thought by first following the redirection with YES I already activated a download in Malzilla.

Thx,
Mike