False positive or true virus on certain websites ? how to know

Viruses and worms
1

Hello

Since several days, when I go to those threes sites:

hxxp:\www.exceltip.com/

hxxp://puremis.net/excel/

hxxp://jmt.puremis.net/index.htm

Avast found Trojans and I can’t acces two those sites

But if I go on those sites on another computer with another antivirus
nothing happens.

Is it the same for you if you go to thoses websites on a computer with Avast ?

I’m surprise that the webmaster of those sites haven’t clean their sites if it is a real virus .
(Can it be a false positive for the three sites ?).

PS: Forgive for my english, it’s not my language. :-[

2

I would say the sites are definitely infected.
A reference for you: http://www.unmaskparasites.com/ just type the URL’s in to the space indicated. All your URLs are analysed as suspicious.
I would say, at least in this case, you are safer with Avast than with the other AV you tried.
The webmaster will only know the site is infected if someone tells him (or her.)

Your English is very easy to understand, and a great deal better than any other language I speak!

Welcome to the forum.

3

Thank you for your answer Tarq57

I will tell them what’s going on with their sites.
By the way, Avast show me an alert when “I’m googling” these sites in the results page.
(but I haven’t click yet on the links ?)
It occurs when I use Firefox but not occurs with IE 7
Why ?

EDITION: I go to the site and suspicious they are as you said
But then I go there
hxxp:www.google.com/safebrowsing/diagnostic?site=www.exceltip.com
And the result is:

What is the current website xxx.exceltip.com?

This site is not considered as a suspect yet.

Where is the truth ???

4

Now that I don’t know.
I tried a Google search of the first two sites you posted, and there was no warning message unless the link was clicked.

5

Thanks again Tarq57 for your help

See the image below

http://zepload.com/images/1242475609_erreurET.jpg

I have clean my cache, close Firefox and reopen it

and when I go on Google and search for exceltip Avast prevents me immediately there’s a virus

Have you tried ?
hxxp:www.google.com/safebrowsing/diagnostic?site=xxx.exceltip.com

6

Blacklist Doctor, that also analyses pages shows the first URL appears to have been hacked and this code inserted (see image), the second script tag goes on for a bit longer. Warming avast will allert on the analysis of blacklist doctor as it is effectively importing the page source. No detections on the next two, but a manual check confirms they too have been hacked, see below.

The jmt.puremis.net/index.htm has also been hacked with the insertion of an obfuscated javascript, script tag after the closing Head tag, see image 2.

The same is true of the puremis.net/excel/ URL script tag after the closing Head tag.

7

Hello

Thanks for your help DavidR

I go to Blacklist Doctor today and it says: Not Blacklisted

So I go on exceltip.com and “miracle” Avast stay quite.

I think the webmaster has clean his website.

(Isn’t it ? It’s safe now ?)

8

You’re welcome, thanks for the update.

You have at the lease to confirmatory sources, avast and the blacklist doctor scan, so it ‘should’ be clean. Though like life no guarantees.