Avast marking web page as virus - why

HonzaZ · 2015-08-18T13:49:30.000Z

I am unblokcing them, but I spotted some very suspicious subdomains pointing to 85.143.216.53:
automatic.ellecouturegowns.com
strongest.ellecouturegowns.com
etc.

I strongly suggest updating all systems and changing all passwords (especially passwords of DNS hosting), or the domains might automatically be blocked in the future again.

system · 2015-08-18T13:52:59.000Z

Thank you.
Any other suspicious subdomains?
We’ll change passwords for DNS hosting.
When will your updates be live?

polonus · 2015-08-18T20:23:31.000Z

This should be taken up with the hosting party.

The website htxp://use-wear-talk.com/ is still being blocked and I see various server configuration issues that have not been remedied, see:3 warnings: https://asafaweb.com/Scan?Url=use-wear-talk.com

See risk status: http://toolbar.netcraft.com/site_report?url=http%3A%2F%2Fuse-wear-talk.com%2F

See: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fuse-wear-talk.com%2F

and http://aw-snap.info/file-viewer/?tgt=http%3A%2F%2Fuse-wear-talk.com%2F&ref_sel=GSP2&ua_sel=ff&fs=1

jQuery load page issue: assets/e4ca9e9b/jquery.js pagination issue.
Why the hxxp in this lines of code starting at line 1380


1380:  < iframe src=hxxp://fast.wistia.net/embed/ iframe /nogii33cpi" allowtransparency="true" frameborder="0" scrolling="no"
1381:  class="wistia_embed" name="wistia_embed" allowfullscreen mozallowfullscreen webkitallowfullscreen oallowfullscreen
1382:  msallowfullscreen width="100%"> < / iframe > < script src=hxxp://fast
.wistia.net/assets/external/E-v1.js" async> < / script >

concerning Wistia dot com Javascript Player API → E-v1.js
→ this is malicious according to Sucuri’s: https://www.virustotal.com/en/url/f6354c32cc1358503f478e56c0a0dfe426c03556b90b63d90dff27e166283daf/analysis/

Consider: http://www.exedb.com/systemfiles/e-v1,postroll-v1.js.html
used in a combined attack with hijacked DNS and affecting the the .js.php files…

polonus (volunteer website security analyst and website error-hunter)

system · 2015-08-19T05:38:23.000Z

DNS passwords have been changed.
The sites are still blocked, have they been unblocked?

polonus · 2015-08-19T10:42:38.000Z

Also flagged: http://oscarotero.com/embed/demo/index.php?url=http%3A%2F%2Fwww.framesemporium.com&options[minImageWidth]=0&options[minImageHeight]=0&options[facebookAccessToken]=&options[embedlyKey]=&options[soundcloudClientId]=YOUR_CLIENT_ID&options[oembedParameters]=

polonus

HonzaZ · 2015-08-19T13:00:10.000Z

Hi,
Apparently whole IP 85.143.216.53 was blocked - I am unblocking it now.

system · 2015-08-19T13:03:59.000Z

85.143.216.53 is not ours…

polonus · 2015-08-19T13:30:59.000Z

No it is not, and this also seems blocked by Avast: http://bestbuydiet.net/
because url is not valid. Suspected of ROKSO Spamming.

polonus

system · 2015-08-19T13:36:05.000Z

Could be however I am interested exactly why Avast blocked our sites, only suspicion is not enough.
Official answer from the team was that sites were blocked becouse of Avenger EK virus.

polonus · 2015-08-19T14:22:15.000Z

See for instance here: http://1col.ru/www.ellecouturegowns.com
I see no items, the hidden asp code is for s a state control mechanism. It is used to preserve viewstate and control state.

They are usually included in a div element,

as we see here.

polonus

system · 2015-08-20T15:53:33.000Z

All domains except hxxp://www.ellecouturegowns.com/ have been unblocked, thank you HonzaZ.
Please unblock this last domain aswell.

Regards,
Drazen

polonus · 2015-08-20T20:40:31.000Z

Why is this in the code there

 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n

See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

system · 2015-08-20T20:45:48.000Z

Where did you find this code?

polonus post:30:

Why is this in the code there
 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

HonzaZ · 2015-08-20T20:50:33.000Z

Should be ok in the next update

polonus · 2015-08-20T20:55:53.000Z

Code is given in the Russian Low Level Site Explorer, just the code from that webpage, line 179

································function·trackSearch(env,·txt)·\r\n
································{\r\n
\t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
\t\t\t\t\t\t\t\t····$.ajax({\r\n
\t\t\t\t\t\t\t\t\t····url:·'GownsWS.asmx/SearchTracking',\r\n