Avast marking web page as virus - why

system · 2015-08-19T05:38:23.000Z

DNS passwords have been changed.
The sites are still blocked, have they been unblocked?

polonus · 2015-08-19T10:42:38.000Z

Also flagged: http://oscarotero.com/embed/demo/index.php?url=http%3A%2F%2Fwww.framesemporium.com&options[minImageWidth]=0&options[minImageHeight]=0&options[facebookAccessToken]=&options[embedlyKey]=&options[soundcloudClientId]=YOUR_CLIENT_ID&options[oembedParameters]=

polonus

HonzaZ · 2015-08-19T13:00:10.000Z

Hi,
Apparently whole IP 85.143.216.53 was blocked - I am unblocking it now.

system · 2015-08-19T13:03:59.000Z

85.143.216.53 is not ours…

polonus · 2015-08-19T13:30:59.000Z

No it is not, and this also seems blocked by Avast: http://bestbuydiet.net/
because url is not valid. Suspected of ROKSO Spamming.

polonus

system · 2015-08-19T13:36:05.000Z

Could be however I am interested exactly why Avast blocked our sites, only suspicion is not enough.
Official answer from the team was that sites were blocked becouse of Avenger EK virus.

polonus · 2015-08-19T14:22:15.000Z

See for instance here: http://1col.ru/www.ellecouturegowns.com
I see no items, the hidden asp code is for s a state control mechanism. It is used to preserve viewstate and control state.

They are usually included in a div element,

as we see here.

polonus

system · 2015-08-20T15:53:33.000Z

All domains except hxxp://www.ellecouturegowns.com/ have been unblocked, thank you HonzaZ.
Please unblock this last domain aswell.

Regards,
Drazen

polonus · 2015-08-20T20:40:31.000Z

Why is this in the code there

 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n

See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

system · 2015-08-20T20:45:48.000Z

Where did you find this code?

polonus post:30:

Why is this in the code there
 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

HonzaZ · 2015-08-20T20:50:33.000Z

Should be ok in the next update

polonus · 2015-08-20T20:55:53.000Z

Code is given in the Russian Low Level Site Explorer, just the code from that webpage, line 179

································function·trackSearch(env,·txt)·\r\n
································{\r\n
\t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
\t\t\t\t\t\t\t\t····$.ajax({\r\n
\t\t\t\t\t\t\t\t\t····url:·'GownsWS.asmx/SearchTracking',\r\n