Avast is blocking my site

Viruses and worms
1

Hi there,

Avast is putting me in a very upseting situation.

It acuses my website, hxxp://paradalesbica.com.br , with a virus.

But ALL THE OTHER antivirus says that my site is ok.

Apparently is a bug with google chrome…

I just can’t find where is the error, so I guess the error is with avast and I’m telling to all the users of the site to UNINSTALL avast and use another software.

I have like 15.000 views for day, so it’s a bad propaganda to avast.

How can we fix it?

update: sorry, the address was wrong

2

If you search the forums you will find that webshield is in the main very accurate

One of the web guys will be along soon to let you know where the problem is

Uninstalling Avast is not a good idea

3

is that URL correct ?..as i get website down

http://www.downforeveryoneorjustme.com/http://paralesbica.com.br/

4

Can’t access site.

Also, Change http:// to hXtp:// to avoid accidental clicks.

5

Sorry, the address was wrong, here is the right: hxtp://paradalesbica.com.br

6

wepawet - suspicious
http://wepawet.iseclab.org/view.php?hash=c9fdd002c6884a4ac90c6e77f7f77f9b&t=1329171665&type=js

urlQuery - suspicious
http://urlquery.net/report.php?id=21187

7

can you attach a screen shot of the avast warning ?

8

Then do as suggested - please modify the link (change http to hXXp) as in my quoted text, so it isn’t active to avoid accidental exposure to a suspect site.

9

What is avast alerting? Example: URL: Mal

10

Ok, the reputation says suspious, but no alert was founded.

So, what can i suppose to do?

Thanx to who is trying to help. :slight_smile:

(I already changed the prefix)

11

can you attach a screen shot of the avast warning?
or write down evrything it say ?

12

You can follow Pondus’ advice and attach a screenshot.

Edit:

u beat me to it…again :o

13

Having just visited the site using firefox 10.0.1 I don’t get any alert on the home page ???

So I think you can see why we need a screenshot of the alert window.

14

I’m attaching 1 screens sent by a user. I don’t get the alert too.

15

as you see the URL on that warning is not the one you gave…

virustotal
https://www.virustotal.com/url/92582b3e43a53bfd1bd5da53550ea76fcbfa8b41285e9c069a127d9b6c5c163d/analysis/1329173396/

and that website is dead!
http://www.downforeveryoneorjustme.com/http://megbydesig.osa.pl/showtread.php?t=49892508

16

I take it you don’t have any scripting to the site in the image ?

I use firefox NoScript and also RequestPolicy add-ons and that shows what scripts and cross sites scripts are on the home page and I didn’t find any reference to megbydesign.osa.pl. Presumably you can’t fine any reference to that site in your site ?

So I don’t know if this was a coincidence that this happened whilst that user was on your site or if there were more than just this person reporting it ?

Do you have any ad services built in to deliver ads ?
As there have been times where ads poisoning has occurred, a poisoned ad being displayed on the site, though that domain doesn’t look like any ad server/service.

17

The main url given in the attachment does not seem to come directly from paradalesbica.com.br/2012/02/amor-as-avessas-capitulo-32/

See the HTTP transactions at urlQuery here: http://urlquery.net/report.php?id=21190

Also, avast! is not blocking your site, but another site that is connected to your site based on cross scripting.

18

Well, but i can’t find this url anywhere at the website code…

19

Answer DavidR’s question and we might have a solution.

Viewing the source, there are obvious ads from Hotwords.

20

The site given in the image by the victim is blocked by Google Safebrowsing: hxxp://megbydesig.osa.pl/ Malware detected… If you vsit this site, malicious software may be installed onto your computer. The other site mentioned had problems here: path: -wp-includes/js/jquery/jquery.js?ver=1.7.1 suspicious[suspicious:2] (ipaddr:187.72.171.157) (script)
WOT reputation yellow Trustworthiness low, but not listed in Offensive IP Database (bzimbal report)

IP found suspicious here: hxxp://urlquery.net/report.php?id=21198

polonus