Avast has detected a virus on this page. FalseAlarm or Virus?

Viruses and worms
1

Hi :slight_smile:

How are you?

I was doing some tests how safe is my internet but my Avast has blocked this site hxxp://bcheck.scanit.be/bcheck/raw.php

Browser Security Test: http://bcheck.scanit.be/bcheck/
HomePage: www.scanit.be/

The owner of the website says that his site does not contain dangerous things (viruses…)
"
Help! My anti-virus says there is a virus!
Your anti-virus is doing its job. It detects the exploit we are attempting and warns you about it. The virus it detects is some malicious software that uses the same bug we test for. Apart from exploiting same browser bug the Browser Security Test and the virus have nothing in common. We are not installing any trojans or attempting to infect you with viruses. "

Virus: hxxp://bcheck.scanit.be/bcheck/raw.php [L] JS:XMLParse-A [Expl]

http://www.UnmaskParasites.com/security-report/?page=bcheck.scanit.be/bcheck/raw.php

http://safeweb.norton.com/report/show?url=http%3A%2F%2Fbcheck.scanit.be%2Fbcheck%2Fraw.php&x=8&y=6

http://www.google.com/safebrowsing/diagnostic?site=bcheck.scanit.be/bcheck/raw.php

http://www.novirusthanks.org/services/scan-websites-for-iframes/

Thx and have a nice day. :slight_smile:

2

As stated on the website:

Help! My anti-virus says there is a virus! Your anti-virus is doing its job. It detects the exploit we are attempting and warns you about it. The virus it detects is some malicious software that uses the same bug we test for. Apart from exploiting same browser bug the Browser Security Test and the virus have nothing in common. We are not installing any trojans or attempting to infect you with viruses.
3

Hi JuninhoSlo,

Site is reliable and also mentioned here: http://www.michaelhorowitz.com/malwarelinks.html
For testing purposes this is found on that site: Exploit:Win32/Anicmoo.A
Aliases
Exploit-ANIfile.c (McAfee)
Exploit:Win32/IMG-ANI.k (Kaspersky)
RIFF/Ani_exploit.gen (Norman)
Troj/Animoo-U (Sophos)
Trojan.Anicmoo (Symantec)
TROJ_ANICMOO.AV (Trend Micro)

Alert Level-Severe

The site however can be considered as being benign: http://safeweb.norton.com/report/show?name=scanit.be
I tested OK, but has NoScript running as a in-browser script protection, no avast alert either:
* Passed Mozilla crashes with evidence of memory corruption - passed
* Passed Mozilla crashes with evidence of memory corruption - passed
* Passed Adobe Flash Player video file parsing integer overflow - passed
* Passed Mozilla crashes with evidence of memory corruption (rv:1.8.1.5) - passed
* Passed Apple QuickTime MOV file JVTCompEncodeFrame heap overflow - passed
* Passed Mozilla code execution via QuickTime Media-link files - passed
* Passed Mozilla crashes with evidence of memory corruption (rv:1.8.1.8) - passed
* Passed Mozilla memory corruption vulnerabilities (rv:1.8.1.10) - passed
* Passed Mozilla crashes with evidence of memory corruption (rv:1.8.1.12) - passed
* Passed Mozilla Firefox MathML integer overflow - passed

Congratulations! The test has found no vulnerabilities in your browser!

polonus