Avast thinks that my website has an exploit ?

Win10x64
Avast version 12.3.2280 (build 12.1.3076.11)

My question is whether this supposed exploit is on my PC or something to do with the hosting service.

The host service says there seems to be no problem there.

MBAM complete scan on my PC says No Threats.

Avast complete scan on my PC says No Threats.

My wife’s AVG throws a pop-up to say the site contains an exploit.

My PC displays Connection Reset error when trying to display my site. Amending my Avast Exclusion List has allowed the site to display as normal.

An iPad displays my site as normal.

An Android tablet displays my site as per normal.

I wonder where is the problem exploit.

Thanks for advice.

What is the exact message avast is giving you ?
What is the website ? (make the link not clickable by replcacing http with hxxp)

Thanks Eddy

The message is on wife’s AVG.

On my PC I don’t know where to see Avast logs so I see only the Connection Reset During Loading as a browser error screen. Or rather saw because on my Avast PC I successfully excluded the web address to make the site display. Now I have removed that address from the exclusion list, but Avast still allows the site to be normally displayed with no error. Possibly needs a reboot.

The site address is : hxyz//2013northcyprus DOT oldtownardgay DOT info .

On the wife’s PC AVG notice now pops up with the screens attached.

INFECTED > https://sitecheck.sucuri.net/results/2013northcyprus.oldtownardgay.info

Suspicious > http://www.UnmaskParasites.com/security-report/?page=2013northcyprus.oldtownardgay.info

Thank you Pondus

I will discuss with hosting server support.

I haven’t run scans/checks (yet), but one thing I already notice is the domain name.
It is a sub-domain.

Googling for oldtownardgay doesn’t show any result for the site within the first 100(!) results.
It is already strange that the main site (the link you give is a sub-domain) doesn’t show up in the search results.
That is making already all alarm bells ringing.

Googling for oldtownardgay.info gives 1 result to the site and makes AVG (and others) showing alerts.
Ouch my ears!
Bell are getting louder and louder.

Infected :
http://zulu.zscaler.com/submission/show/1ff8c5a9c916391673e7264caa0d7331-1478622453
https://quttera.com/detailed_report/2013northcyprus.oldtownardgay.info

Blacklistings on that ASN :
http://urlquery.net/report.php?id=1478622540995

Wordpress insecurities :
Warning User Enumeration is possible
The first two user ID’s were tested to determine if user enumeration is possible.
ID User Login
1 PlantHunter PlantHunter
2 None

Warning Directory Indexing Enabled

Vulnerable library used :
http://retire.insecurity.today/#!/scan/dbf8789226e3a21a83639772b0f263ff8036dffb6cc10d12c5338045d15d9fd9

Cloaking detected: There is a difference of 18 bytes between the version of the page you serve to Chrome and the version you serve to GoogleBot. This probably means some code is running on your site that’s trying to hide from browsers but make Google think there’s something else on the page. show.

				<a href="htxp://2013northcyprus.oldtownardgay.info/"><img src="htxp://2013northcyprus.oldtownardgay.info/wp-content/uploads/2013/06/cropped-DSC3141-2_01.jpg" class="header-image" width="1000" height="290" alt="" /></a>
				<a href="htxp://2013northcyprus.oldtownardgay.info/"><img src="htxp://2013northcyprus.oldtownardgay.info/wp-content/uploads/2013/06/cropped-2013-04-10_CyprusDay01_111_011.jpg" class="header-image" width="1000" height="293" alt="" /></a>

Served from: -2013northcyprus.oldtownardgay.info @ 2016-11-08 17:23:19 by W3 Total Cache →
Served from: -2013northcyprus.oldtownardgay.info @ 2016-11-08 17:23:20 by W3 Total Cache →

The scan found some potential problems in the code, the links below should pop you down to the line.

line 104:block of sc​ript is frequently used either to insert malware or spammy links.
See: https://aw-snap.info/file-viewer/?tgt=http%3A%2F%2F2013northcyprus.oldtownardgay.info&ref_sel=GSP2&ua_sel=ff&fs=1

Link to -beta.szki.kotk.hu?/js/jquery.min.phpc this website has been disabled! This is a tracking developer’s site.

Retireable code: -http://2013northcyprus.oldtownardgay.info
Detected libraries:
jquery-migrate - 1.4.1 : -http://2013northcyprus.oldtownardgay.info/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
jquery - 1.12.4 : (active1) -http://2013northcyprus.oldtownardgay.info/wp-includes/js/jquery/jquery.js?ver=1.12.4
Info: Severity: medium
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
(active) - the library was also found to be active by running code
1 vulnerable library detected

Hacked through WP-emoji?

polonus (volunteer website security analyst and website eror-hunter)