Avast marking web page as virus - why

system · 2015-08-19T13:36:05.000Z

Could be however I am interested exactly why Avast blocked our sites, only suspicion is not enough.
Official answer from the team was that sites were blocked becouse of Avenger EK virus.

polonus · 2015-08-19T14:22:15.000Z

See for instance here: http://1col.ru/www.ellecouturegowns.com
I see no items, the hidden asp code is for s a state control mechanism. It is used to preserve viewstate and control state.

They are usually included in a div element,

as we see here.

polonus

system · 2015-08-20T15:53:33.000Z

All domains except hxxp://www.ellecouturegowns.com/ have been unblocked, thank you HonzaZ.
Please unblock this last domain aswell.

Regards,
Drazen

polonus · 2015-08-20T20:40:31.000Z

Why is this in the code there

 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n

See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

system · 2015-08-20T20:45:48.000Z

Where did you find this code?

polonus post:30:

Why is this in the code there
 179 \t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
See: https://www.virustotal.com/nl/ip-address/91.201.55.91/information/

polonus

HonzaZ · 2015-08-20T20:50:33.000Z

Should be ok in the next update

polonus · 2015-08-20T20:55:53.000Z

Code is given in the Russian Low Level Site Explorer, just the code from that webpage, line 179

································function·trackSearch(env,·txt)·\r\n
································{\r\n
\t\t\t\t\t\t\t\t····var·ip·=·'91.201.55.91';································\r\n
\r\n
\t\t\t\t\t\t\t\t····$.ajax({\r\n
\t\t\t\t\t\t\t\t\t····url:·'GownsWS.asmx/SearchTracking',\r\n

polonus

HonzaZ · 2015-08-21T08:20:18.000Z

Btw several subdomains still point to malicious IPs, for example:

Name: acknowledges.ellecouturegowns.net
Address: 85.143.216.53

and many more:
acknowledges.ellecouturegowns.net
automatic.ellecouturegowns.com
strongest.ellecouturegowns.com
democratic.ellecouturegowns.info
depreciation.ellecouturegowns.net
fight.ellecouturegowns.org
ingres.ellecouturegowns.net
jean.elledancestudio.com
recognized.ellecouturegowns.org
staff.ellecouturegowns.org
analysis.ellecouturegowns.net
plains.ellecouturegowns.org

If this does not stop immediately, the domains will be blocked again!

system · 2015-08-21T09:35:33.000Z

We are not using ellecouturegowns.net domain at all for our webs, although we have it registered. We use only .com suffix.
85.143.216.53 was generic () godaddy DNS entry for any subdomain on ellecouturegowns class of domains (net,org,com…).
I have removed "" DNS entries, please check now. It will take some time for DNS to get propagated.

Regards,
Drazen

polonus · 2015-08-21T10:40:35.000Z

This has a Netcraft Risk Rating of 7 red out of 10: http://toolbar.netcraft.com/site_report?url=http://85.143.216.53
bulk registering.
You are out on left AS → http://bgp.he.net/AS201848 → as-block: AS201216 - AS202239
This AS number doesn’t appear to exist right now, and so we are unable to generate a report.

polonus

HonzaZ · 2015-08-21T12:58:21.000Z

Thanks for the info, Drazen!

system · 2015-08-22T19:38:49.000Z

HonzaZ, ellecouturegowns.com is still blocked, please check.

Regards,
Drazen

HonzaZ · 2015-08-22T20:42:48.000Z

I can access the website without any warning - can you post the printscreen? What does the warning say?

system · 2015-08-22T20:55:05.000Z

https://www.dropbox.com/s/xv9apvicx06wpcs/Screenshot%202015-08-22%2022.49.54.png?dl=0
Virus definition version: 150820-1

Regards,
Drazen

essexboy · 2015-08-22T20:56:42.000Z

No problems with IE11 or Edge here

jeffersonsant · 2015-08-22T21:04:05.000Z

Using Internet Explorer 11 and Firefox 40.02
tested in both load normally there is no problem.

system · 2015-08-23T07:12:17.000Z

Same with freshly installed Firefox 40.02, virus definition version 150822-0
https://www.dropbox.com/s/uk6q5ha1p5anyv4/Screenshot%202015-08-23%2009.11.11.png?dl=0
HonzaZ, please check.

Regards,
Drazen

HonzaZ · 2015-08-23T07:20:30.000Z

I have no idea why it appears as malicious. The URL is definitely not blocked now. Perhaps it is still in the cache somewhere? Did you try restarting your PC?
Rest assured that your visitors do not see any warnings now, as Essexboy and Jefferson confirmed

system · 2015-08-23T07:35:24.000Z

It should not be in any cache since this is fresh install of Firefox 40.02.
Restarting the PC helped

Regards,
Drazen

HonzaZ · 2015-08-23T08:34:39.000Z

I was thinking more about cache of Avast - when it blocks something and sees it for the second time in a short while, it blocks it automatically without actually checking it. Of course this “short while” is set for a sufficient short amount of time: after a couple of minutes (?) the cache is invalidated. Perhaps there is a bug that prevented invalidating Avast cache in your specific case, therefore Avast didn’t bother to check if it is blocked and fetched last result, which is “block this URL”.

I am glad this is now resolved ;-)!

Announcements