Avast (Mac only) reports JS-Downloader on my site

Viruses and worms
1

Avast (Mac Only, with Safari) is reporting an “Infection detected” on my site. Two users have reported the same problem. I don’t get this message on my local computer that runs Windows when I tested it with Firefox and Safari.

Infection type: JS:Downloader-JC[Trj]
http://www.energyjustice.net/map/nationalmap
File: {gzip}
Process: /System/Library/StagedFrameworks/Safari/Webkit.framework/A/XPCServices/com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking

I’ve developed the website and am using several JS libraries from well-known sources (like Google Maps, JQuery, etc) as well as my own code.

How can I identify which, if any, of my libraries are the cause?

Or is the problem with the nationalmap page? It has embedded javascript.

2

outdated apache https://sitecheck.sucuri.net/results/www.energyjustice.net/map/nationalmap

html scan
https://www.virustotal.com/en/file/7763c5f5bb996d8ab422af52c703381d5feef150950e6e6a1cc3ad1efa9026aa/analysis/1437596856/

if you think it is wrong you may report it here https://support.avast.com > avast virus lab

3

Thanks for those useful web resources!

It is probably a false positive, possibly due to errors in my javascript.

Fortunately my local (slightly newer) version of the software pasts the test. So I’ll try uploading that.

4

When I include a link to the main file with most of my JS libraries, VirusTotal gives me a Avast warning. When I remove the link to the libraries I don’t get the warning.

When I test the libraries on their own - it doesn’t give me a warning.
http://www.energyjustice.net/map/js/libs.min.js.php

https://www.virustotal.com/en/file/0316d9f7ca1c9e66af83127e40fae9ad8c77c7941decfcaae6caa8d07af81469/analysis/1437604095/

It might be upset that I’m using a php extension for the javascript. I’m doing this so that I can gzip the libraries (for speed). Gzip might be viewed as obfuscation and untrustworthy.

So I changed it to use a .js extension and now it works!

5
So I changed it to use a .js extension and now it works!
Case solved then ;)