I am confused about an infection being Blocked.

Viruses and worms
1

I am using a MacBook Pro with Google Chrome as my browser.

Hello! Here is a little back story. I was watching some of James Veitch’s videos on YouTube. (If you don’t know who he is, he responds to spam emailers to mess with them and waste their time) Wanting to know more about what he does I Googled his name. The first website Google gave me appeared to be his website. So I clicked on it. What I thought was a Mac notification popped up saying my flash was outdated. Not caring I clicked close or cancel (I don’t remember which it said). After nothing happened I realized what it was. I quickly jammed the back arrow as avast notified me of a blocked infection.

Infection: JS:Includer-BOF [TrJ]
URL: (I don’t want to link the site for your safety)
File: (gzip)
Proscess: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome

To make sure everything was clean on my Mac I cleared Chrome’s cache and cookies. What is confusing me the most is now everytime I Google James Veitch I get an infection blocked notice even thought I don’t click on the fake site. (Also something to note I wasn’t notified about an infection block while on Google until after I had clicked the link.)

Why does this happen? Is my Google safe to use? Is there a way to fix this?

Any help is appreciated.

I am also running a full system scan to make sure nothing got through.

2
URL: (I don't want to link the site for your safety)
Post the link unclickable http as hxxp www as wxw
3

URL: hxxp://veitch.me/

Sorry, didn’t think about that.

4

Blacklisted :
http://www.urlvoid.com/scan/veitch.me/
https://www.virustotal.com/en/url/3c0fe3b9c3e00164a2e566fe4dced2490933526334c12c7944b81a9a5cbda571/analysis/1485859193/

Blacklistings on that IP :
https://www.virustotal.com/en/ip-address/108.167.140.114/information/

Blacklistings on that AS :
http://urlquery.net/report.php?id=1485858450185

Infected :
https://sitecheck.sucuri.net/results/veitch.me

Vulnerable library used :
http://retire.insecurity.today/#!/scan/7e5deb1679aec22f48e364f4323dacb320cfaf5746c5fae9ebc8f04787a0478b

Old Wordpress version used

5

HTML scan > URL: hxxp://veitch.me/

https://virustotal.com/en/file/4d0e58f85fcdc102b613dab31bb16a789a0a34328b69010129e7b9d0e2f6821d/analysis/1485877130/

To make sure everything was clean on my Mac I cleared Chrome's cache and cookies. What is confusing me the most is now everytime I Google James Veitch I get an infection blocked notice even thought I don't click on the fake site. (Also something to note I wasn't notified about an infection block while on Google until after I had clicked the link.)
If this is still a problem you can ask in the Mac forum section, you may give link to this topic
6

I wanted to thank you guys for getting back to me. I ran a system scan on my MacBook and everything came back clean, except 27 files couldn’t be scanned but that shouldn’t be a problem. I wasn’t really expecting to find anything because Avast said it blocked it but wanted to make sure.

As for my Google search problem. It appears to have gone away. I can now search James’ name without getting a blocked infection notice. After looking at the virustotal page Pondus linked I am surprised so few antivirus’ recognized the threat. I am glad I choose to use Avast.

Thanks again you guys. If I have any other questions or infections I will be back. :smiley:

7
After looking at the virustotal page Pondus linked I am surprised so few antivirus' recognized the threat. I am glad I choose to use Avast.
Most malicious files start there life undetected / low detection rate

Avast have always been good at at detecting infected websites. There are many examples here that avast and Sucuri are the first to detect