Infected site not detected

On a french forum, a site http://www.anysonglyrics.com/lyrics/r/rkelly/Trapped-In-The-Closet-Lyrics.htm is infected.

Avast ( with the latest version and virus database up to date ) don’t detect the virus. I’ve downloaded and tested Nod32.

I’ve disabled avast! ( last version, virus database up to date ).
With Nod32 running, I get the following message : “probably a variant of HTML/Exploit.CodeBaseExec trojan”

Can someone explain me why ?

Thank you very much.

Another poor detection? ::slight_smile: ??? :o

http://forum.avast.com/index.php?topic=15303.0
http://forum.avast.com/index.php?topic=15300.msg129025#msg129025

OK, now I’m concerned as it’s something strange going on with avast! detections recently… :-\ I think I’ll have to use my TrendMicro housecall more than once a month… :-\ As I recently found avast detects ~40000 viruses only. :-\ But it still remains my favourite program! :wink:

Well, Technical, I believe you’re rather fast on judgement. There always were things that avast! didn’t detect (just as any other AV), and there always will be.
“Probably a variant of HTML/Exploit” doesn’t sound very convincing to me; it’s obviously some kind of heuristics, no exact detection, decision based on some HTML snippet - it doesn’t sound very certain (i.e. NOD also doesn’t detect it for sure). I’m not saying NOD doesn’t have a nice heuristics, but this may not even be a malware.

YLAP: As explained multiple times, the number has absolutely no meaning. Every company is counting the samples differently. For example, tens of thousands (maybe more? no idea) of avast! “Trojan-Gen” detections are not taken into account in the number you see.

I've disabled avast! ( last version, virus database up to date ). With Nod32 running, I get the following message : "probably a variant of HTML/Exploit.CodeBaseExec trojan"
@ gtaillandier The key to this detection is 'probably' is this a heuristics detection? Has it been confirmed that it isn't a false positive. Also it is not advisable to post an active link to a suspect location, you can edit the link remove the http://www. this will protect from accidental exposure.

@ =YLAP=

As I recently found avast detects ~40000 viruses only.
This has been the case for a long time, not to mention this has been discussed numerous times, the topic on numbers can't easily be compared as different AVs use different methods of naming and counting.

Now I know! ;D Besides, I’m happy to use avast! as it hasn’t failed me yet. But all these post about not detected viruses made me concerned… :wink:

Sorry, but I’m French and I haven’t undestood all what was written in topics 15303.0 and 15300.msg …

Can someone explain me without technical terms ?

Thank you very much.

Sincerely.

Hmm, I have visited the link and indeed Internet Explorer warned me that there is an ActiveX component. Also the site is desgined with several large arrows pointing to that IE warning bar, describing where I should click and what should I do to install the “lyrcis search software” or whatever.

Seems to me that the author of that page really wanted me to download his software, but is this a virus??? I don’t really know …

What are you referring to?
My last week infection? I’m absolutely sure I was infected. More than 2000 recurring files were installed, I have to use AVG for DOS and on-line scanning/cleaning, it took me two hours to get rid from it… I don’t think I was sleeping or misundertanding about what happened… It was an infection.
The point is: I’ve submitted the samples to Alwil and more than 15 days passed and nothing happened.. I just ask that you are as fast in your samples analysis than I’m in my judgement :frowning: