Avast blacklisting

Viruses and worms
1

Hi
My web site in www ilmiomarket .com is blacklisted by Avast.
The site is clean and no virus found.
Could you please solve this issue?
Thanks for a replay

2

what does the avast warning say?
can you attach a screen shot ?

3

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles

4

This page seems to be suspicious inline script found.
http://www.UnmaskParasites.com/security-report/?page=www.ilmiomarket.com

urlQuery - suspicious
http://urlquery.net/report.php?id=16468

5

These are the screenshot I receive…

Regarding suspicious inline script are you talking about this?

ifAjaxOnLoad()

6
Regarding suspicious inline script are you talking about this?
I am not talking about anything, i just give you the info found by online scanners

but yes that is the one Unmask Parasites show

but you can use the link Asyn posted to report False Positive

7

@ jizzy

  • Please ‘modify’ your post change the URL from http to hXXp or www to wXw, to break the link and avoid accidental exposure to suspect sites, thanks.

For me another question is why is winlogon.exe (not your browser) trying to make the connection ?
The reason I ask is this is more normally associated with hidden malware on your system trying to connect to a malicious site. Were it not for the fact that this is your site I would certainly though that this was the case.

8

@DavidR
…hidden malware on your system…

I checked everywere. I also checked with securi.net tools but web site is clean.
Is there any avast-tool to check my web site?
Is not possible avast antivirus stop my web site with no information to solve the problem … (if any).

9
  1. It is just unusual to see winlogon.exe connecting to the internet, I have only ever seen this kind of thing associated with malware, so under normal circumstances I would be suggesting further analysis. But your situation differs in that the connection attempt it to your own site, not one that the malware using a system file to connect to.

That is why I asked how you were actually connecting to your site, if not by browser.

  1. There is no tool to check your site other than the avast program, it is being blocked by the network shield as the domain is in the malicious sites list that the network shield checks against.

  2. You have seen that Pondus gave a link to UnmaskParasites and the suspicious inline script, now you have to find where that iframe is located and determine if A) you put it there and if it is legit. However, this suspicious inline script may not be why the network shield considers the site malicious.

Have you recently had an infection on the site that has now been cleaned up ?
As that could be one reason it ended up on the malicious sites list.

  1. Aysn also gave a link to report a possible False Positive, there you can ask for a review of your site in relation to a Network Shied alert/block.
10

Thanks for support

  1. Yes, about 1 month ago I had to reinstall web site cause an attach, but this problem is recent (about ten days) and my web site is not in any blacklist… only Avast stop my web site

  2. About the UnmaskParasites as suggested by Pondus I found where that script is located but it is correct

  3. As Asyn suggested I used that form to report False Positive… will I receive a replay or not?

  4. I haven’t any other idea how to solve… is someone able to check and clean my web site? I’ve not enough experience in these problems. You may contact me directly at jizzy @ jizzy .net

Thanks

11

  1. Then that may be what resulted in the addition to the malicious sites listing.

  2. As I said it may not have been that which was responsible for the listing, given your comment on previous attack, then that is the more likely reason.

  3. That is the way to ask for the review and generally they don’t contact you they are normally quick to check and correct when confirmed. I normally give a link in that reporting process back to the avast forum topic as we have seen input back in the forum topic.

  4. There is no one in the forums that can do that for you, we are for the most part avast users and really is a task for specialists. I would ask your Host if they have any advice on the aftermath of the attack, with regard to prevention as cleaning (however this was done) will only be effective if any vulnerability that allowed the site to be hacked isn’t found and closed.

Also see, Tips for Cleaning & Securing Your Website, http://www.stopbadware.org/home/security.

Also see, Help: I Got Hacked. Now What Do I Do? http://technet.microsoft.com/de-de/library/cc512587(en-us).aspx.

12

Thanks.
I hope Avast team remove this problem…
How many days I have to wait ?

13

You’re welcome.

There isn’t a time frame as such, generally (based on previous forum topics) it is relatively quick.

14

Hi
The suspiciois inline script is not a problem… I setup on another web site
http://www.unmaskparasites.com/security-report/?page=www.notiziarioimmobiliare.com
the same script
That web site is not blocked by Avast

Avast team write me for a screenshot… (about 6 hours ago)
No more news
Thanks

15

SOLVED
Now my web site is visible also for avast users
Thanks all

16

You’re welcome, as usual doesn’t take long once reported and confirmed.

You can open your first post and click the Modify button and add [Solved] to the Subject.