avast! claims there’s something called ‘JS: Redirector/ga.js’ on each and every one of the webpages with Google Analytics, which seems to be a false-positive.
(File Name: http://www.google-analytics.com/ga.js)
Haozip.exe is an RAR manager, in case you don’t know about it.
This file is extracted from a machine running avast! which blocked the js. Let me know if you want a copy of the file.
I cannot find anything when I go to where you get the alerts. So it must be something in your browser cache that is being alerted, or in the profile of this. Cleanse your firefox browser and then try again,
It is screen shots I found on another forum. Also, have you seen the links I posted? The poster of the second link seems to be a staff from a Chinese enterprise, Kingsoft, whose official website is also blocked by avast!.
There are hosts of guys having the same issue. Neither could I get alerts when opening the link directly, though. But since it’s claimed to be a ‘redirector’, perhaps it would be blocked only by Webshield or whatever.
There have been instances of the script tag for Google Analytics being hacked, but I can’t recall if this also indicated the ga.js file (I don’t think so). Given the masses of script tags out there pointing at this ga.js file is this file was infected or even an FP there would be a flood of posts on the forums about it and we aren’t seeing that.
Hello,
i wrote you yesterday on email. Could you send me content of js if you are still performing any problem? Becouse i can’t find this detection on http://www.google-analytics.com/ga.js
Do you have VPS up-to-date?
Best regards
Jan Sirmer
@ ziucqea
Certainly looks like a hacked google-analytics script tag/file, this has included a call to another site 17bbj.com, which is most likely suspect in a similar way to the reference I made to the blog post. See image of the decoded script with the inclusion/insertion of the call to the 17bbj.com site.
@ Jan
It is possible that this script could be detected by avast which would kind of defeat the purpose of displaying it, I always display script example as images to ensure there is no possibility of avast alerting in the forums.
3 years old…gotta pay more attention to detail I guess. Your comment made me smile a little, but a little miffed?
Why does the problem still exist after 3 years. or is the current version of the Google script “clean”. Thinking about re-registering the site with google and using
the latest(?) script. Does that make any Sense?
