Avast reporting malware on my site - but it's the only one reporting it!

General Topics
1

Hi all!

So created a website, hosted locally, all worked well for a while. Then I bought hosting, and put it there, with my domain name. All seemed well for a couple of hours.

Then Avast started to report a malware HTML:Script-inf.

I first tried online tools, but every online tool reports my site to be ok
http://zulu.zscaler.com/submission/show/82e830ddc9c49baa65342be07adae34a-1406214322

Only case was one of them said my cPanel is outdated. Nothing I can do about it, but I called the host provider, and they told me they would get a lot more complains if that was the actual problem.

So I started to do some tests. I ended up creating a very simple html file locally, and sure enough, anytime my site is in the html as a src (let’s say for a javascript file) it reports it as a threat.

I called Avast support and they tell me the problem is my machine, something wrong in my registries, and they want to sell me some windows engineer support. I ran CCleaner and everything is fixed/fine, but the issue persist. I ran all the updates.

Anyone here is talented enough and would be willing to look at my site and see if there is a real threat, and if yes, what/where it is? I would gladly fix it!

Thanks!

Michel

Oh, my site is http://michel-roberge.com

2

Sucuri (Outdated cPanel Found) http://sitecheck.sucuri.net/results/michel-roberge.com

VirusTotal
https://www.virustotal.com/en/file/0f41ffa464ada690a1fb2d23de2ce34355d111f1757d1078f4dbadf475167c3a/analysis/1406216425/

can you attach a screenshot of the avast popup warning

3
called the host provider, and they told me they would get a lot more complains if that was the actual problem.
I know for sure that they are getting a lot of complains about it. If you search this webboard, you will find many people that have GoDaddy and complained about it.
I called Avast support
No, that is not avast support. It is a third party and it is really bad.

Pondus, it shows as URL:Mal

4
Pondus, it shows as URL:Mal
that is not what he say he see
Then Avast started to report a malware HTML:Script-inf.
https://www.virustotal.com/en/file/0f41ffa464ada690a1fb2d23de2ce34355d111f1757d1078f4dbadf475167c3a/analysis/1406216425/
5

It show up as URL:Mal when I try to open the site.

And on the VT links > michel-roberge.com.htm < strange name for a file.

6

Thanks guys for looking it up!

that is not what he say he see
Yes, it says Url:mal, and when I extract it from quarantine and scan it I see Malware HTML:Script-inf. Sorry I wasn't clear on this.

Sorry no screenshot as I have uninstalled Avast for now (until I get this fixed) on my current machine. I can re-install later and give it a try.

As for michel-roberge.com.htm - I think that’s because it runs the index.php which spouts out HTML and it saves it and parse it (parses the actual output instead of the php).

Sucuri (Outdated cPanel Found) http://sitecheck.sucuri.net/results/michel-roberge.com
I did see this, and contacted goDaddy, and like I said, they say that cannot be the reason for no sites would be accessible from their hosts through avast. I would tend to agree this makes sense...

I am not going in denial mode (as I have seen here and there) - all I want is to fix this. I don’t rule out any possibilities. I am all for cleaning / fixing it - but I need to find out WHAT needs to be fixed :slight_smile:

Thanks

7
I know for sure that they are getting a lot of complains about it. If you search this webboard, you will find many people that have GoDaddy and complained about it.

I just did a quick search on the Avast forum and it seems you are right, there’s a lot popping up! But always the combination of “Only Avast” and GoDaddy.

That’s strange! Who is the culprit? Avast or GoDaddy?

Perhaps I should consider moving everything out of goDaddy…

8

As you likely know, it is always a good practice to use the latest version of software.
Especially if security flaws are fixed in the latest version.

So if anything is “the culprit”, I would say it is GoDaddy and not avast.

cPanel 11.40.1.11 (as GoDaddy is using) was released on 04-02-2014
Several other version have been released since then.
The latest on is 11.44.1.7 released… Yesterday!

https://documentation.cpanel.net/display/ALD/Change+Logs
As you can see there, several security flaws have been fixed.

Ofcourse there will be people going into discussion if a av should block websites that use outdated software.
In my opinion, I say yes. It is helping to protect users/visitors and the website owners.

You can always request avast to allow your domain through the contact form:
www.avast.com/contact-form.php

I am asking you to change the text on your website about this, because now you know what is going on.
Perhaps even put a link to this thread there.

Just to avoid misunderstandings, I am not working for avast.
Just like Pondus, you and most people here on this webboard, I am just a user with some (since 1983) experience with computers.

9

sorry I did it slightly out of a naughty feeling I had. I will be removed in the next minute.

Sorry :slight_smile:

Michel

10

I can understand why you did it.

If you haven’t already done so, ask avast through the contact form to allow your domain.

And tell GoDaddy to tell you the truth if you are ask them something :wink:

11

I removed the picture (which is the bad thing I did) and changed the title. The rest of the text is still true - only avast is reporting my site as being bad.

Nonetheless, I am on the line with godaddy and am trying to solve the problem. The lady said “you have been hacked”. I asked “why do you say that?” and she wouldn’t tell me. Turns out she thought I was hacked because of new content… but I was the one who added the content, so I wasn’t hacked.

I did fill the form of false positive website.

I’ll see what comes out of it!

Thanks again

12

No, avast is not reporting your site is bad as I have tried to explain.
It is saying that there is a security risk.
Which is true since GoDaddy is using a 5 months outdated cPanel.

The lady said "you have been hacked". I asked "why do you say that?" and she wouldn't tell me
She could have said "I have no clue what I am talking about and I don't care as long as I get paid" At least she would have been honest if she did ;D

But anyway, let’s see what avast says/does now you have asked them to allow the domain.

13

oh! I gotcha. So you’re convinced Avast is blocking it because of the older cPanel?

I just asked the lady to give me one other site running on the same cPanel, also hosted by goDaddy. She gave me one, I tried it and got no problem:

http://wsb7.timetogetthepapers.com/

So it doesn’t look like the issue is cPanel per say. Or at least, not only that.

I will download everything local and tinker with it try to find what is triggering this…

thanks for the help!

14

Not necessarily because of the older cPanel, but that introduces a vulnerability which could be exploited. It is vulnerabilities like this which could lead to a site being hacked.

When URL:MAL is the alert depending on where the alert happens, it normally means that there is a link in there to a malicious site.

Your first post mentions HTML:Script-inf, which normally means script injection on that page, so check any script tags that you have on the page/s, are they yours/legit. Often these happen after the closing html tag, but not always. It would probably be best to check any php template documents.

The main thing is to use the contact form link given by Eddy in Reply #7, asking for a review of your site. A link to this topic wouldn’t hurt.

One of the problems with goDaddy is multiple domains on the one IP address (depending on the hosting package you have). So it is possible you may have an IP address block rather than a domain block (sins of others).

15

Ok, I sent a link to avast to this thread. My goDaddy host is supposed to be a dedicated IP address, but there is another domain name tracing to the same IP… old stuff maybe?

16

Ok, I did another small test because I am hardly able to sit on this…

I created a dummy html page on my PC with this text:

<html>
<header>
<script type='text/javascript' src='test.js'></script>
</header>
<body>
<h1>Test malware</h1>
</body>
</html>

No problem. I then changed my html to this:

<html>
<header>
<script type='text/javascript' src='http://michel-roberge.com/test.js'></script>
</header>
<body>
<h1>Test malware</h1>
</body>
</html>

And of course, avast catched it.

Now if I replace my domain with the one mentioned earlier (http://wsb7.timetogetthepapers.com/) which - in principle - runs on the same host (godaddy) and on cPanel, then it works (no trigger from avast).

Should I then understand that it’s because Avast goes on http://michel-roberge.com in the root and actually finds something else, or is this site cached as being malicious until further notice? I just am trying to make sure I understand everything right.

Thanks a ton!

Michel

17

ISSUE DETECTED DEFINITION VULNERABLE HEADER
Outdated cPanel Found cPanel Security cPanel 11.40.1.11
But this could not be a reason for the avast! alert/
DNS SOA issues → Connecting to smtp.secureserver.net (68.178.213.203) fails.
Connection to mailstore1.secureserver.net (68.178.213.203) fails.
Sending Mail via IPv4 to dns@jomax.net fails.
Getting Email for SOA RNAME by michel-roberge.com (dns.jomax.net) fails at a test with dns@jomax.net.

GoDaddy experienced DNS poisoning issues before.

polonus

18

that is scary to read.

I will contact them on this - of course I suspect they will go in denial mode again. I will nonetheless link back to here (again) and if nothing happens in the next few days then I think it is time to consider moving somewhere else…

thanks!

19

Ok… So now something strange is happening.

I got myself a unique IP:

http://23.229.240.18

and when I go straight there, it’s fine.

But when I go through http://michel-roberge.com I get the same avast warning.

So now it seems the problem is really on the DNS side right?

20

Hi michel_roberge,

secureserver.net is and was on several malware domain lists and your IP is “ip-23-229-240-18.ip.secureserver.net”
That could have been a reason, but actually I do not know, not being an avast! team member.
My extrapolations just come from some check-results I performed.
avast! team should answer the question why your address was put on the avast! general URL:Mal block list.
As there is WordPress 3.9.1 “http-generated” there is this vulnerability, e,g,: https://core.trac.wordpress.org/ticket/28610

This is not avast! flagged either: http://toolbar.netcraft.com/site_report?url=https://p3plcpnl0548.prod.phx3.secureserver.net

Did you report to virus@avast.com, giving a link to this thread’s info? Whenever there is something conclusive they are known to react quickly and whenever a general block can be lifted, it sometimes occurs with a forthcoming update.
Anyway thanks for reporting.

Stay safe and secure, is the wish of

polonus