Author Topic: Trouble detection on a link [SOLVED]  (Read 2448 times)

0 Members and 1 Guest are viewing this topic.

gamer789

  • Guest
Trouble detection on a link [SOLVED]
« on: January 03, 2012, 07:00:01 PM »
Hi,

I got some alert about this link : http:// e-cpm.fr/promote1.php , there is a "malware" which concerned cpmtrafficker.com

But for some other people, their Avast does not react (silent mode desactivated !), and we have the same version (software & VPS) and configuration of Avast, no adblock or noscript.

Is it normal ? This link http:// e-cpm.fr/promote1.php has really a malware or not ?

Can someone click on this link http:// e-cpm.fr/promote1.php and say if he has an alert please ?

Thank you.

edit screenshot :
« Last Edit: January 03, 2012, 07:59:59 PM by gamer789 »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37532
  • Not a avast user
Re: Trouble detection on a link
« Reply #1 on: January 03, 2012, 07:05:14 PM »
VirusTotal URL scan
http://www.virustotal.com/url-scan/report.html?id=dc7bd8201b4ba82010c36e1222ba147d-1325609749

VirusTotal HTML scan
http://www.virustotal.com/file-scan/report.html?id=034c751a4801e881f830bda80ff9da72091a8daead6a083e85494bc84b73f158-1325613428

Sucuri / Unmaskparasites say clean

urlQuery - suspicious
http://urlquery.net/report.php?id=14389



What malware is avast reporting ?

can you attach a screen shot of the avast warning ?

« Last Edit: January 03, 2012, 07:28:13 PM by Pondus »

gamer789

  • Guest
Re: Trouble detection on a link
« Reply #2 on: January 03, 2012, 07:12:28 PM »
By "test", I mean click on the link, virustotal say nothing, but their Avast (   6.0.1289.0 ) isn't the last version ( 6.0.1367 ), maybe it's why there's no reaction.

So, can someone click on this link http:// e-cpm.fr/promote1.php before I ban this link from my website ?

Thank you.
edit
screenshot
« Last Edit: January 03, 2012, 07:15:22 PM by gamer789 »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37532
  • Not a avast user
Re: Trouble detection on a link
« Reply #3 on: January 03, 2012, 07:20:28 PM »
jsunpack show this link and say suspicious....same as in the avast warning

-http://cpmtrafficker.com/publishers/adserving/insertions/display.php?t
oken=MjYwfDMwMHgyNTB8MzAwfDI1MHwx

VirusTotal URL scan
http://www.virustotal.com/url-scan/report.html?id=baf918e544a3a38312ca71523079ba42-1325610584

VirusTotal HTML scan
http://www.virustotal.com/file-scan/report.html?id=d688817ad30047bdbe5b3de6cc61015e70149a6947ebad087bc008f957ba2c4a-1325614189


urlquery - suspicious
http://urlquery.net/report.php?id=14394

« Last Edit: January 03, 2012, 07:27:35 PM by Pondus »

ady4um

  • Guest
Re: Trouble detection on a link
« Reply #4 on: January 03, 2012, 07:22:59 PM »
Please next time post the relevant avast detection as a very little jpg attachment, not an irrelevant full screen which includes adds when opening its outside link >:(.

spg SCOTT

  • Guest
Re: Trouble detection on a link
« Reply #5 on: January 03, 2012, 07:24:59 PM »
Expanding on the report about cpmtrafficker, there are two ad iframes in the e-cpm site. (e-cpm.png)

These iframe ads contain further links/iframes, one of which avast blocks via the network shield. (cpmtrafficker.png, network-shield.png)

This is most likely the reason for the alert.




gamer789

  • Guest
Re: Trouble detection on a link
« Reply #6 on: January 03, 2012, 07:38:09 PM »
Please next time post the relevant avast detection as a very little jpg attachment, not an irrelevant full screen which includes adds when opening its outside link >:(.

oops sorry, I took the first one I found  :-[

Expanding on the report about cpmtrafficker, there are two ad iframes in the e-cpm site. (e-cpm.png)

These iframe ads contain further links/iframes, one of which avast blocks via the network shield. (cpmtrafficker.png, network-shield.png)

This is most likely the reason for the alert.

Yay ! so there is really an alert  :) My Avast works fine  ;D I can ban this site.

Thank you very much.