Fake AV redirect not detected by avast?

Viruses and worms
1

Or this site redirection is dead, or the malware is not detected?
Scanned ikweu.php at htxp://markussonphoto.com/ikweu.php?do=marco%20pantani
See:
http://www.virustotal.com/file-scan/report.html?id=6c504cbe6fc21947330d87999c37dc6d9aeaf2b26dd69b46190bb5252395a6a6-1298751036

10 more instances found there, see: http://www.browserdefender.com/site/markussonphoto.com/
redirecting found to google.com e.g. htxp://www.google.com/extern_js/f/
CgJlbhICdXMrMEU4ACwrMFo4ACwrMA44ACwrMBc4ACwrMCc4ACwrMDw4ACwrMFE4ACwrMAo4AEAvLCswFjgALCswGTgALCsw
JTjPiAEsKzA1OAAsKzBAOAAsKzBBOAAsKzBNOAAsKzBOOAAsKzBUOAAsKzBpOAAsKzAYOAAsKzAmOAAsgAI2kAIx/NtlEJEP-IWM.js
see for above → http://wepawet.iseclab.org/view.php?hash=03392fd082a652f4e49ea02073aa1391&t=1298752396&type=js
Wepawet gives it as clean

polonus

2

Eleven threats found by Norton… :frowning:

http://safeweb.norton.com/report/show?name=markussonphoto.com

3

The site seems to be clean now, but Sucuri report it blacklisted

4

Yes Pondus,

I think this IP is cleansed: http://www.malwaregroup.com/Ipaddresses/details/66.96.132.77
response dead here as well: http://support.clean-mx.de/clean-mx/viruses.php?id=473624
see: http://www.robtex.com/ip/66.96.132.77.html

polonus