Detects VBS:Malware-gen on my site http://www.thefunnyplanet.com/ since 4pm!

Viruses and worms
1

I have been notified of it… My server nor anything is hacked…still avast is showing it…

What could be the problem?

Expecting a reply ASAP!

Website Link ~ http://thefunnyplanet.com

Please reply…

2

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles

Report 2011-12-09 11:52:55 (GMT 1)
Website thefunnyplanet.com
Domain Hash 588a1c14ea748c9a7de52c3cf74c51a6
IP Address 50.116.84.208 [SCAN]
IP Hostname -
IP Country – (–)
AS Number 36351
AS Name SOFTLAYER - SoftLayer Technologies Inc.
Detections 0 / 23 (0 %)
Status CLEAN

Report 2011-12-09 12:48:13 (GMT 1)
IP Address 50.116.84.208
IP Hostname -
IP Country –
AS Number N/A
AS Name N/A
Detections 0 / 26 (0 %)
Status CLEAN

3

Ok…thanks for the reply…

But my other website… http://quotesfun.com is also giving the same error! :frowning:

please check! :((

what is wrong with AVAST!

4

I got the problem!

Its http://www.histats.com/

Its AFFECTED!!! :expressionless:

removed it from footer and its all good! :slight_smile:

5

Hello,
this is a false positive. Unfortunately histats script was added in our malware database. It will be fixed in next virus definition release.
Sorry for your inconvenience

6

Report 2011-12-09 12:07:19 (GMT 1)
Website quotesfun.com
Domain Hash d9f6350ec62bd612d63456b84b9883a0
IP Address 173.242.125.181 [SCAN]
IP Hostname -
IP Country – (–)
AS Number 46664
AS Name VOLUMEDRIVE - VolumeDrive
Detections 0 / 23 (0 %)
Status CLEAN

Report 2011-12-09 13:01:24 (GMT 1)
IP Address 173.242.125.181
IP Hostname -
IP Country –
AS Number N/A
AS Name N/A
Detections 0 / 26 (0 %)
Status CLEAN

PS: Both sites also clean on Sucuri.

7

thanks for the reply both of you! (:

Histats will be MAD! :stuck_out_tongue:

8

You’re welcome…!

9

Fix virus definition update will be released ASAP

10

www.consultnews and clicksergipe.com.br also alerts the same virus. it seems that is FP. How can we fix it?

thanks.

Juliano

11

Just wait. :wink:

12

I have he same problem with my sites:

hxtp://—.org/
hxtp://—.com/

please check! (

what is wrong with AVAST!

13

Just removed histats and it’s all fine now

14

Ok, the VPS update is out now.
Solved for you guys…??

15

Hi,

I’m just wondering why this happen to my site at http://www.telepisodes.net too ? When I check the site on other site checker like SiteAdvisor and Norton Safe, it checked my site and it is safe… Where’s the issue came from? From HiStats’ script or the ADS script on our site? Can anyone from AVAST explain it to us so that at least we can make some necessary move, decision or adjustments on this incident.

Thanks in advance for any response.

16

See Reply #4. :wink:

17

Hi telepisodes,

This is the suspicious bit there:
www.telepisodes.net/about/ suspicious
[suspicious:2] (ipaddr:46.19.139.180) (jsvar) -www.telepisodes.net/about/
status: (referer=-www.telepisodes.net/)saved 43624 bytes ddbf9d47cfadf8d6e3441d058f1969b3c3156ec4
info: [javascript variable] URL=-www.telepisodes.net/about/
info: [script] -cdn.telepisodes.net/wp-includes/js/l10n.js?ver=20101110
info: [script] -cdn.telepisodes.net/wp-includes/js/jquery/jquery.js?ver=1.6.1
info: [script] -cdn.telepisodes.net/wp-content/themes/arthemiaxx/telscrpt.js
info: [script] -cdn.telepisodes.net/wp-content/themes/arthemiaxx/daves.js
info: [img] -cdn.telepisodes.net/telenet.png
info: [script] -ad.adorika.com/st?type=ad&size=728x90&section=1994858
info: [input] -cdn.telepisodes.net/wp-content/themes/arthemia/images/magnify.gif
info: [iframe] a-d.xtendmedia.com/st?type=iframe&size=336x280&section=1764052
info: [iframe] -ad.xtendmedia.com/st?type=iframe&size=300x600&section=1764052&flash=1
info: [img] -sstatic1.histats.com/0.gif?1417482&101 That’s it!
info: [script] -edge.quantserve.com/quant.js
info: [img] -pixel.quantserve.com/pixel/p-deb3UCO4t-TqU.gif
info: [script] -apis.google.com/js/plusone.js
info: [decodingLevel=0] found JavaScript
suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes

polonus