Avast is Blocking my website, what should I do?

[Lisandro]

I'm sure 1000000% I have no malicious code on my site!!!

Check here how to clean and make a website secure.

The vast majority of malware today is distributed over the web, mostly by means of hacked (otherwise legitimate) sites. The attacker usually injects malicious some scripts into some (or all) pages on the site, waiting for an unsuspecting user to visit the site and possible infect his/her machine.

And this is where avast’s detection capabilities really excel. Its abilities to detect these web-based malicious scripts are second to none, and thanks to the Web Shield and Script Blocking providers, they are used exactly when needed, doing an excellent job stopping the web-based malware right on the entry point.

[BANDiT600]

http://www.google.com/safebrowsing/diagnostic?site=dancesport.ru
http://sitecheck.sucuri.net/results/dancesport.ru

There is no malicious code or something on my site. I have checked logs and so on, I have read how to clean my site and make'em secure. But nothing to clean.

[Pondus]

@BANDiT600    it would help if you told us what avast say...
can you attach a screen shot of the avast warning ?

[polonus]

Hi BANDiT600,

Going to the code of that page, I see this: -vkontakte.ru/js/api/share.js?9 suspicious
[suspicious:2] (ipaddr:87.240.188.254) (script) -vkontakte.ru/js/api/share.js?9
     status: (referer=-www.dancesport.ru/)saved 11333 bytes b76365ec69fa297471be445d558ed77dc412e6b2
     info: [img] -vk.com/images/vk16.png
     info: [decodingLevel=0] found JavaScript
     error: undefined function document.getElementById("form").submit
     suspicious
Not much here: htxp://wepawet.iseclab.org/view.php?hash=bbd59b98c11ff4277fee937238fcf3db&t=1329231062&type=js  apart from some adware tracking

Given suspicious here: htxp://urlquery.net/report.php?id=21420

polonus

[BANDiT600]

@BANDiT600    it would help if you told us what avast say...
can you attach a screen shot of the avast warning ?

Avast warning says: Malicious url hxxp://rambler-analytics.ru/ajax.js

[BANDiT600]

Hi BANDiT600,

Going to the code of that page, I see this: -vkontakte.ru/js/api/share.js?9 suspicious
[suspicious:2] (ipaddr:87.240.188.254) (script) -vkontakte.ru/js/api/share.js?9
     status: (referer=-www.dancesport.ru/)saved 11333 bytes b76365ec69fa297471be445d558ed77dc412e6b2
     info: [img] -vk.com/images/vk16.png
     info: [decodingLevel=0] found JavaScript
     error: undefined function document.getElementById("form").submit
     suspicious
Not much here: htxp://wepawet.iseclab.org/view.php?hash=bbd59b98c11ff4277fee937238fcf3db&t=1329231062&type=js  apart from some adware tracking

Given suspicious here: htxp://urlquery.net/report.php?id=21420

polonus

I don't understand what is malicious in social comments script of social network Vkontakte.ru???

[polonus]

Hi BANDITiT600,

There is a world of difference from some part of the code being found as  probably suspicious and code being malicious, so malcode as such.
It would be welcomed if you could provide us with an image as what is specifically flagged by avast.
Sucuri does not give any warnings on non-updated, non-patched code. That is great.
vkontakte is your counterpart of facebook and facebook has loads of isues...
But if you think this could be a false positive, report to avast, report here:  http://www.avast.com/contact-form.php?loadStyles

Also consider this: hxtp://vscan.urlvoid.com/analysis/9b2a7b3651476cd8d33fc29a75be2a83/YWpheC1qcw==/  given clean

polonus

[BANDiT600]

Here is screenshot.

And BTW, vscan.urlvoid.com says everything is clean.

[polonus]

Hi BANDiT600,

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles

polonus

[BANDiT600]

Hi BANDiT600,

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles

polonus

Yes, thank you. I have reported about it yesterday, but still no answer.

[Konsta]

hi there!

i have the problem, that avast blocks my website for no reason :/

i checked already everything on the page for bad files etc. but everything is clean!

could you unblock my page please - it would be nice if it happens as fast as possible: http://boulderwelt.de/

[DavidR]

Please 'modify' your post change the URL from http to hXXp or www to wXw, to break the link and avoid accidental exposure to suspect sites, thanks.

This is the Network Shield blocking your site as it is considered malicious.

Sucuri shows clean, http://sitecheck.sucuri.net/results/boulderwelt.de/ as does http://urlquery.net/report.php?id=82943. But it looks like their might be other domains on this IP also, you are possibly being blocked by IP rather than domain name.

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Undetected Malware; Press (Media), issues.

- If you are reporting an FP, then you get another input field open, enter the web URL for the site you wish to submit for review (Network Shield), etc. A link to this topic also wouldn't hurt.

[polonus]

This is a hick-up in the code:
boulderwelt dot de/plugins/bgstretcher/bgstretcher.js benign
[nothing detected] (script) boulderwelt dot de/plugins/bgstretcher/bgstretcher.js
     status: (referer=boulderwelt dot de/)saved 20520 bytes 9bc81219597dc7d0ade629522c6f1e1add14472f
     info: [img] boulderwelt dot de/plugins/bgstretcher/
     info: [decodingLevel=0] found JavaScript
     suspicious:
Nothing here: http://wepawet.cs.ucsb.edu/view.php?hash=2e3bfc22fb5b9010edf1e88c4b1b166d&t=1341493569&type=js

polonus

[ckike]

Hi I am also getting the Avast Blocked Messages in my site wxx.listacasa.com

We have scan everything and its OK. Please we need your help to resolve this.

Thanks!

[DavidR]

If you scanned using the sites above http://sitecheck.sucuri.net/scanner/ and http://urlquery.net/ and they also come up clean then reported it as outlined in my Reply #1 above.

I see nothing reported on Sucuri SiteCheck or URLQuery.net.

However, it looks like your host has other domains on this IP address so it could be that one or more of those is infected and the IP address is blocked, which effects your domain.