F/P

[gabrielcoronel]

Hola
Tengo el sitio web (hxxp://www.hn-hercules.com.ar/index2.htm) donde la versión 6.0.1125 da un falso positivo. aparentemente.
El virus parece estar en un Flash (SWF), el archivo tiene un enlace, creo que este enlace es el que causa el falso positivo

Si alguien puede aportar algo al respecto agradecería.
Saludos.

Hello
I have the website (hxxp://www.hn-hercules.com.ar/index2.htm) where the version 6.0.1125 is a false positive. apparently.
The virus appears to be in a Flash (SWF) file has a link, I think this link is causing the false positive

If someone can make something about it would appreciate.
Greetings.

[kubecj]

This is added at the end of the swf file:

<IFR AME SRC="http://www.ciudad. com.ar/ar/popunder/p_submit.asp?site=personales.ciudad.com.ar" width=1 height=1></IFR AME>

and we most probably block it. Is this stuff there intentionally, ie you want it there?

[gabrielcoronel]

Hola
Si es muy probable que esta informacion, esté alli aproposito.
Pero igualmente no es un virus, ni ningun otro tipo de amenaza.

Hello
If it is very likely that this information, especially designed to be there.
But equally it is not a virus, or any other threat.

Gracias

[gabrielcoronel]

Hoy al ingresar a la pag web, ya no se manifieta el problema. La falsa alarma ya dejo de producirce.
Problema resuelto.
Ahora me gustaria saber si es que se corrigio al cambiar algo en las nuevas firmas del antivirus.
Muchas gracias.


Today when entering the web page no longer the problem is manifested. The false alarm and producirce stopped.
Problem solved.
Now I would like to know if that was corrected by changing something in the new antivirus signatures.
Thank you very much.

[DavidR]

You could check for the presence of the offending iframe tag that kubecj gave in his post.

If it is still there then it is likely to be a corrected signature, if the iframe tag has been removed from the end of the .swf file then it was in fact a suspect inserted iframe tag.