Avast free detects malicious virus and it is clean

my url is wxw.cristobalpenalva.com and Avast freecdetects malicious virus.
Can you help me, please?

Thanks

yea…they always say that…completely clean…avast is wrong. :wink:

sucuri
http://sitecheck.sucuri.net/results/www.cristobalpenalva.com/
http://labs.sucuri.net/db/malware/malware-entry-mwiframehd5

Zulu analyzer
http://zulu.zscaler.com/submission/show/077fe1b859f9b765c9d14d0dac99ede2-1340965325

urlQuery
http://urlquery.net/report.php?id=78403

url scan
http://vscan.novirusthanks.org/analysis/029a7f2a8e84252b52055aea734e73f8/aW5kZXg=/

so…still think it is clean. ::slight_smile:

Doesn’t look clean at all… ;D

@cpm: Please make your link unclickable…!!! Example: wxw.cristobalpenalva.com

ok,
I will check my web.
Thanks!

virustotal
https://www.virustotal.com/file/d34d48e9d77cd4e3e99a754fc7092f9f312641e0c31d4d7f8429aa258044d56b/analysis/1340966881/

Avast! doesnt get it on VT…looks like VT is behind on VPS updates. ???

Good idea…!!
You’re welcome.

It rather depends as this is a web shield detection and that may not be detected in a standard on-demand scan of VT depending on the web shield alert.

If you are just throwing a URL at VT to scan there are numerous times when this doesn’t return anything.

Reported as malicious link here: hxxp://labs.sucuri.net/db/malware/malware-entry-mwiframehd5

See attached below.

EDIT: This should not happen with a securi link?

Wrong, it happens with many analysis sites as they can display the content/example and avast alerts on it.

This seems to be the case here, see image extract of page source and VT results on that page, https://www.virustotal.com/file/85075e1adf13627938937f954782e2710afe8fa70cc64539ceef744cff65c288/analysis/1340988268/.

@DavidR,

Thanks for that. Apparently the VT link indicates this is actually a BlackHole Exploit Kit or a part of it, anyway. :wink: For the unwary and unsavvy, this would be the piece that takes the cake.

Thanks for the link and thanks for explaining how Avast! would alert on content displayed at securi or other url scanning sites.

Learn something new every day. BTW version 7.0.1451 is installed now, so…

You’re welcome.