Avast marking web page as virus - why

HonzaZ · 2015-08-19T13:00:10.000Z

Hi,
Apparently whole IP 85.143.216.53 was blocked - I am unblocking it now.

system · 2015-08-19T13:03:59.000Z

85.143.216.53 is not ours…

polonus · 2015-08-19T13:30:59.000Z

No it is not, and this also seems blocked by Avast: http://bestbuydiet.net/
because url is not valid. Suspected of ROKSO Spamming.

polonus

system · 2015-08-19T13:36:05.000Z

Could be however I am interested exactly why Avast blocked our sites, only suspicion is not enough.
Official answer from the team was that sites were blocked becouse of Avenger EK virus.

polonus · 2015-08-19T14:22:15.000Z

See for instance here: http://1col.ru/www.ellecouturegowns.com
I see no items, the hidden asp code is for s a state control mechanism. It is used to preserve viewstate and control state.

They are usually included in a div element,

as we see here.

polonus

system · 2015-08-20T15:53:33.000Z

All domains except hxxp://www.ellecouturegowns.com/ have been unblocked, thank you HonzaZ.
Please unblock this last domain aswell.

Regards,
Drazen

polonus · 2015-08-20T20:40:31.000Z

Why is this in the code there

 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n

See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

system · 2015-08-20T20:45:48.000Z

Where did you find this code?

polonus post:30:

Why is this in the code there
 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

HonzaZ · 2015-08-20T20:50:33.000Z

Should be ok in the next update

polonus · 2015-08-20T20:55:53.000Z

Code is given in the Russian Low Level Site Explorer, just the code from that webpage, line 179

································function·trackSearch(env,·txt)·\r\n
································{\r\n
\t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
\t\t\t\t\t\t\t\t····$.ajax({\r\n
\t\t\t\t\t\t\t\t\t····url:·'GownsWS.asmx/SearchTracking',\r\n

polonus

HonzaZ · 2015-08-21T08:20:18.000Z

Btw several subdomains still point to malicious IPs, for example:

Name: acknowledges.ellecouturegowns.net
Address: 85.143.216.53

and many more:
acknowledges.ellecouturegowns.net
automatic.ellecouturegowns.com
strongest.ellecouturegowns.com
democratic.ellecouturegowns.info
depreciation.ellecouturegowns.net
fight.ellecouturegowns.org
ingres.ellecouturegowns.net
jean.elledancestudio.com
recognized.ellecouturegowns.org
staff.ellecouturegowns.org
analysis.ellecouturegowns.net
plains.ellecouturegowns.org

If this does not stop immediately, the domains will be blocked again!

system · 2015-08-21T09:35:33.000Z

We are not using ellecouturegowns.net domain at all for our webs, although we have it registered. We use only .com suffix.
85.143.216.53 was generic () godaddy DNS entry for any subdomain on ellecouturegowns class of domains (net,org,com…).
I have removed "" DNS entries, please check now. It will take some time for DNS to get propagated.

Regards,
Drazen

polonus · 2015-08-21T10:40:35.000Z

This has a Netcraft Risk Rating of 7 red out of 10: http://toolbar.netcraft.com/site_report?url=http://85.143.216.53
bulk registering.
You are out on left AS → http://bgp.he.net/AS201848 → as-block: AS201216 - AS202239
This AS number doesn’t appear to exist right now, and so we are unable to generate a report.

polonus

HonzaZ · 2015-08-21T12:58:21.000Z

Thanks for the info, Drazen!

system · 2015-08-22T19:38:49.000Z

HonzaZ, ellecouturegowns.com is still blocked, please check.

Regards,
Drazen

HonzaZ · 2015-08-22T20:42:48.000Z

I can access the website without any warning - can you post the printscreen? What does the warning say?

system · 2015-08-22T20:55:05.000Z

https://www.dropbox.com/s/xv9apvicx06wpcs/Screenshot%202015-08-22%2022.49.54.png?dl=0
Virus definition version: 150820-1

Regards,
Drazen

essexboy · 2015-08-22T20:56:42.000Z

No problems with IE11 or Edge here

jeffersonsant · 2015-08-22T21:04:05.000Z

Using Internet Explorer 11 and Firefox 40.02
tested in both load normally there is no problem.

system · 2015-08-23T07:12:17.000Z

Same with freshly installed Firefox 40.02, virus definition version 150822-0
https://www.dropbox.com/s/uk6q5ha1p5anyv4/Screenshot%202015-08-23%2009.11.11.png?dl=0
HonzaZ, please check.

Regards,
Drazen

Announcements