False/Positive, anyone can confirm?

[system]

So the url is: http://www.google.lt/#hl=lt&source=hp&q=bernelių+užeiga&btnG=Google+Paieška&meta=&aq=f&oq=bernelių+užeiga&fp=5c1ddf1576f464ee

Its google (google.lt - lithuanian) rezultas page for search of “berneliu uzeiga”. I am getting warning about trojan right when google shows results (without clicking anything).

Is it Avast trying to prefetch the first result (infected www.berneliuuzeiga.lt) or there is trojan infected google results? (top result sitelinks?)

Using:
Avast 4.8 (Home Edition), Build: Aug2009 (4.8.1351) All fully updated.
Firefox 3.5.3 all fully updated.
Windows XP Professional Edition all fully updated.

Any ideas/hints? (-;

[Maxx_original]

read this - http://blog.avast.com/2009/06/18/google-new-malware-hosting/ we’ve seen such things before…

[system]

Nice, so its up for google to clean it’s database?

[system]

As far as i’m aware, it is not avast! prefetching the results it is your browser…firefox…

@spg SCOTT post:4

I think this may be firefox’s pre-fetch function, the same thing happens to me and when I disabled it this alert doesn’t happen.
I think that the prefetch function pre-fetches the first search result from google

If you want to turn it off and try it for yourself:

-Open a new tab
-type “about:config” into the address bar (without quotes) [you will have to click the box that says you’ll be careful]
-in the filter bar type: “network.prefetch-next” (without quotes)
-right click the entry and click toggle

Now you can try the google search

Make sure you are careful within this config page, changing some values could prove troublesome

Hope this helps,

-Scott-

@gloomers post:3

Nice, so its up for google to clean it’s database?

Pretty much, but you could help:
Report a bad google search: http://www.google.com/safebrowsing/report_badware/

[system]

Hey,
it looks like you were right when you said it’s about on the first site of the results. Try it out: if you type in the first result, the same message will appear, especially some suspicious iframe. So it’s not even on the first site of results. It might be a result of some XSS hacking ( cross-site hacking )