Help with VBS:Malware-gen

system · September 15, 2012, 2:32pm

From today whenever i open my site http://dailytipsndtricks.blogspot.com Avast is showing my site as a infected one but i scanned my site online with many malware testers but the result was “No Malware or infections were found on your site” But avast is showing MALWARE BLOCKED message at the bottom of my browser whenever i open my site and it’s pages. What should i do?

Pondus · September 15, 2012, 2:54pm

Can you post a screenshot of the avast warning

what online test have you run?

DavidR · September 15, 2012, 4:09pm

Two compressed script files are being loaded when visiting your site

hXXp://dailytipsndtricks.blogspot.co.uk/|>{gzip} [L] VBS:Malware-gen (0)
hXXp://dailytipsndtricks.blogspot.co.uk/YOUR-FAVICON-URL|>{gzip} [L] VBS:Malware-gen (0)

Whilst on virus total there is essentially only avast detecting this, that isn’t an indication that it is wrong as we have seen this before and avast has had a high degree of accuracy on these detections in the past.

https://www.virustotal.com/file/b8565cd4f8afc15192dfa01def2a6e60a72f61882b9cb68db2bac57791b6799c/analysis/1347725090/
https://www.virustotal.com/file/891c4531a8898bc62ae06a499338b66b421aa8b68061a86546efe0abb5cf3b56/analysis/1347725172/

system · September 15, 2012, 5:41pm

Hi friend! Is there any way to stop those compressed files from running an opening my site!

system · September 15, 2012, 5:43pm

Hi friend! Is there any way to stop those compressed files from running an opening my site!

DavidR · September 15, 2012, 6:09pm

Well I don’t know if they are intended to run when your site loads and if they are meant to load/legit, is the detection good. But to me anything like this is suspect at the very least, do you have a section/folder in your blog related to ‘YOUR-FAVICON-URL’ as that doesn’t seem like something you would be blogging about and the actual favicon.ico file is frequently hacked and used for malicious purposes as every page that loads would be trying to load the favicon.ico and malicious scripts could be loaded or run from it.

I don’t know how much control over your website on blogspot.co.uk, but I would ask them about this.

system · September 15, 2012, 6:37pm

I am having the exact same problem on my website, www.ramblingbeachcat.com. I have run it through multiple scans and they have all come up clean, yet I am getting the same avast warning that you are.

system · September 15, 2012, 6:47pm

Here is a screen shot of the two warnings

http://i.imgur.com/63o2J.jpg

http://i.imgur.com/0n71q.jpg

system · September 15, 2012, 8:03pm

Have the same problem on a Blogger hosted site. Same warning re YOUR-FAVICON-URL|{gzip} comes up, and also a warning comes up when I am in the Blogger dashboard attempting to access the HTML. I find it strange that it would trigger being in Blogger. Is there anyway to fix whatever is wrong? Please help. The warning gives no indication of how to fix anything it only asks me to upgrade my product.

I have also ran my site though virustotal and Google’s webmaster tools and no malware is detected. It is just Avast at this point.

Can anyone help?

Thank you very much

system · September 15, 2012, 8:10pm

Here is a screenshot of the Avast warning while in the Blogger dashboard. The other warning regarding the YOUR-FAVICON-URL|{gzip} looks the same as Rambling Beach Cat’s.

http://3.bp.blogspot.com/-xh7K9dmjhxY/UFTgN2jyw-I/AAAAAAAAA9I/QdIWR1a8yHk/s1600/malwareinblogger.jpg

system · September 15, 2012, 8:16pm

Just tried in my template and it happened there for me, too. Not sure if I should be comforted or scared by that :o

system · September 15, 2012, 8:21pm

Isn’t that strange??

Donovan · September 15, 2012, 8:31pm

Hi RamblingBeachCat, tptp & arun100,

First, we need to change your favicon icon to a valid png/ico file.
We will use the following vector: http://www.iconarchive.com/download/i45457/creativenerds/clean-noise-social/blogger.ico
The following is licensed under the Creative Common Attribution 3.0, commercial usage allowed, by Creative Nerds.

[ol]- Log in to your Blogger account

Goto Design > Edit HTML
Be sure to check the “Expand widget templates” box[/ol]

Search (CTRL + F) for YOUR-FAVICON-URL

If found:
Select all of the contents between <link {whatever} /> where {whatever} is anything
NOTE: This should be on one line

If not found:
Search for b:skin
Goto the line above it (b:skin)

Paste the following:

<link href="http://www.iconarchive.com/download/i45457/creativenerds/clean-noise-social/blogger.ico" rel="icon" type="image/x-icon"/>

Then, clear your cache by following the instructions here.

Next, 5 minutes later, attempt to visit your site.
If you are still greeted with alert(s), please provide screenshots of the alerts.
IMPORTANT: Not waiting could result in changes to your site not taking effect.

Finally, Report results in your next post.

~!Donovan

system · September 15, 2012, 8:38pm

Thank you for the response.

Only with these instructions is that my favicon is actually uploaded on a widget on my blog layout. When I search for it in my actual blog template with widgets expanded, it doesn’t show up.

system · September 15, 2012, 8:45pm

Have replaced the code as directed, assuming that we can replace the blogger.ico with our custom ico? Waiting for cache to clear so if I need to use the blogger.ico please let me know.

Thanks, and thanks for your prompt help, too.

Donovan · September 15, 2012, 8:54pm

Yes, if you have your own .ico file you can replace href=“http://www.iconarchive.com/download/i45457/creativenerds/clean-noise-social/blogger.ico” with your icon’s location.

system · September 15, 2012, 8:58pm

Malware warning still coming up, only now it doesn’t say anything about ‘YOUR-FAVICON-URL’, it just says |{gzip}. And I am still getting the same malware warning when I go into Blogger dashboard.

system · September 15, 2012, 9:01pm

Same thing here

http://i.imgur.com/4Aigu.jpg

system · September 15, 2012, 9:18pm

Here is the warning I get from going to my blog’s template design page.

http://i.imgur.com/5HPaZ.jpg

Donovan · September 15, 2012, 9:35pm

Ok…

After many experiments with the html file, I narrowed it down to some javascript code that was causing the alert.

Which means that this code was causing the alert: http://pastebin.com/XNBAxLgU
Note that the code requires jquery before it is treated as malicious

Which A: Looks legit and B: detected as VBS and C: nobody else detects. So I assume it’s a false positive.

Sorry for the inconvenience,
~!Donovan

Help with VBS:Malware-gen

Search (CTRL + F) for YOUR-FAVICON-URL

If not found: Search for b:skin Goto the line above it (b:skin)

Announcements

If not found:
Search for b:skin
Goto the line above it (b:skin)