False positive on site?

Viruses and worms
1

Have recently had a site programmed, and Avast! seems to think the following code is a trojan, but it has been put there deliberately by the programmer! Is there another way he should code this in order to satisfy Avast! that this is not a virus? Any help would be greatly appreciated, thankyou. Here is the code:

function GetMusicData(fakeData)
{
// Sent fake data in order to workaround IIS caching
var url=“nowplaying.asp?fakeData=” + fakeData;

xmlHttp=GetXmlHttpObject(stateMusicChanged);
xmlHttp.open("GET", url , true);
xmlHttp.send(null);

fakeData = fakeData + 1;
setTimeout("GetMusicData("+ fakeData +");", 5000);

}
GetMusicData(1);

2

Well if this is the exact code, then it isn’t very wise to place directly (unbroken) it in the forums as avast would be as likely to alert on this in the forum as in the site.

However, in this case it doesn’t alert, so I guess it needs the script tags to cause the alert.

What are the full details of the alert, malware name, file name and full location.
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe

  • Or check the source file using notepad C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log

When posting URLs to suspect sites, change the http to hXXp so the link isn’t active (clickable) avoiding accidental exposure.

3

Hi!

Thanks for your help with this. I attach the log file for you to have a look at. Does this shed any light on what Avast! is being alerted on?

4

The thing from the log has nothing to do with the code posted. It’s instead the obfuscated link to myXXXXX-XXXXX.com (can’t write the name as it contains only expletives) which provokes the warning. Check the content of the page, you will see that. BTW: We would really like to see the server part of the malware, how does the generator look.

5

Thanks SO much for your help! It WAS something else like you said. Really appreciate it :slight_smile: :slight_smile: :slight_smile:

6

So no false positive then.

Welcome to the forums.