False Positive on Wiggio Website?

Viruses and worms
1

Today several computers at our location have had access to the Wiggio shared calendar website blocked by Avast.

The warning is attached. It’s from a Firefox session on Win 7 but it also occurs in IE on Win XP.

This is definitely a legitimate website, used by several people. This problem did not occur before today.

I certainly do not want to tell people to use the website if it’s been compromised, but a web search does not indicate anything about such an event. So I need to know if this is a false positive as soon as possible.

EndPoint Protection Suite version 8.0.1603 (with SOA 1.3.3.35)
Virus Definitions version 140430-0

Thank you.

2

See my post in this topic about that website…

3

My post:

4

Thank you.

I don’t understand your reference to “the download” though. I don’t see any option to download anything on the wiggio.com page. Avast appears to be detecting a script, which it blocks. The site then displays a message stating that “there was a problem loading a necessary script file”.

But if there’s something that can be downloaded there that is a threat I definitely want to know about it.

5

killmalware report http://killmalware.com/wiggio.com/

virustotal
https://www.virustotal.com/nb/file/080bbd724f26b0368f3aee9e3c4f6d8239f0a0d56e3b88e7a1612b1265a9b878/analysis/1398877784/

6

It might be a legit detection. I don’t know a hole lot about Java Exploits.

I’ll ask Pol to take a look.

7

Hi Michael,

There is iFrame malware flagged on site:
Suspicious

blank dot html’ *
noop dot html’ **
noop dot html’

" Security issue with IFrame based HTML hosting. This results in serious issues with the IFrame staying on top and obscuring important pop-ups.
the iFrame is hidden temporarily while the pop-up is dismissed. Impact is Cross Domain Information Disclosure Vulnerability. A malicious site may be able to modify the iframe of a site in an arbitrary external domain. Attackers could exploit this to gain access to sensitive information that is associated with the external domain. Other attacks are also possible, such as executing script code in other browser security zones. info credits SecurityFocus - mozilla,

** Funny that Web Security scan finds the iFrame flag on the no-op tag, used in assembler-level programming as filler for data or patch areas,
No-op tag could for instance be used to mark out the start and end of a chunk of HTML to be Ajaxed

https site seems OK: http://toolbar.netcraft.com/site_report?url=https://wiggio.zendesk.com
This external link also been checked: htxps://itunes.apple.com/us/app/wiggio/id424059394?mt=8

Scan for uri as given malicious: http://zulu.zscaler.com/submission/show/6be9191a38118fc874c468728c1b9fcc-1398877896

Malware could be a generic worm detection but also riskware. Reason also to concluse a false positive detection.

Damian

8

Ta, hopefully the site removes the iFrame

9

Thank you folks.

10

But it occurs to me to ask:

We have been using this website with Avast here for several months but today was the first time Avast displayed a warning about it. Is it possible to know whether this is because something on the website changed, or did something in Avast change since yesterday?

That would help me to decide whether to permit access to it; if it’s only Avast that changed, then I would presume the site is as safe today as it was yesterday.

Thanks for all your help.

11
We have been using this website with Avast here for several months but today was the first time Avast displayed a warning about it. Is it possible to know whether this is because something on the website changed, or did something in Avast change since yesterday?
whats clean today....can be hacked tomorrow :-\

Every 3.6 seconds a website is infected http://www.scmagazine.com/every-36-seconds-a-website-is-infected/article/140414/

Sucuri blog http://blog.sucuri.net/

12

@KDibble,

With a variant on what Pondus stated in his above posting:
“And what was being blocked to-day can become unblocked via the next virus update.” ;D
Glad to announce the site is no longer being blocked by avast! :wink:

polonus

13

Thank you very much!

Based on everything I read, it appears the primary reason for the block was “riskware”, which, while a good thing to be aware of, is not, in my opinion, a sufficient reason for blocking a site.