FALSE POSITIVE WWW.TOSPITAAL.BE

Viruses and worms
1

My website is blocked by avast.
Why ?

2

It was probably hacked. avast! hardly ever blocks a page due to false positive.
Flying quickly over the page source and i don’t see anything particularly suspicious. I suggest you wait for someone from avast! to check it out and remove detection if found to be false positive.

3

Report 2010-11-09 22:32:41 (GMT 1)
Website tospitaal.be
Domain Hash daf294555d17d1b21cbb713caaa0d736
IP Address 85.119.217.85 [SCAN]
IP Hostname 85.217-119-85.cust.rackboost.net
IP Country BE (Belgium)
AS Number 35219
AS Name BE-RACKBOOST-AS Rackboost NV
Detections 3 / 17 (18 %)
Status DANGEROUS

Sorry, can’t provide newer info, as I get this now:
Domain does not exist or is unaccessible.
asyn

4

Asyn reach before me :wink: but according to norton your website is dangerous because of a virus
http://safeweb.norton.com/report/show?url=tospitaal.be

Threat Report
Total threats found: 1

	 Viruses (what's this?)
Threats found: 1
Here is a complete list:
Threat Name:	W32.Koobface
Location:	 www.tospitaal.be/h3hqdtl7/setup226583.exe

Anubis:
http://anubis.iseclab.org/?action=result&task_id=1bf3edf2773c8d3646929588d599fce30

5

Avast is generally very accurate on these and isn’t alone in considering the site infected, see http://www.urlvoid.com/scan/tospitaal.be. Strange thing it is showing the IP country as Switzerland and an earlier report for the BE IP address.?

Seems you have moved it recently, image2 & 3.

So it looks like a good detection and your site appears to have been hacked (again).

6

I 've recently moved my website to new vps.
I moved it probably including the virus/hacks
Now,the original website has been erased.
So I made a total new website.

Could you scan my website again please ?
thank you all for help!

Jean-Marie Huys

7

http://www.UnmaskParasites.com/security-report/?page=www.tospitaal.be

URL: http://www.tospitaal.be
Redirects: 302 → http://www.tospitaal.be/web
301 → http://www.tospitaal.be/web/
Google: not currently listed as suspicious* (details)
Generator: Joomla! 1.5 - Open Source Content Management
Last checked: 0 minutes ago (results are cached for 1 hour)

8

You can contact avast and ask for this - There is a new on-line contact form, http://www.avast.com/contact-form.php?loadStyles for: * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Press (Media), issues.

Give the details and say it is a detection by the Network Shield blocking access to the site and can they review the domain again, a link to this topic wouldn’t hurt.

9

Hello,
it will be fixed in next VPS
Regards