Malicious URL - False Positive

Viruses and worms
1

Avast saying my websites have viruses, but all are clean.

hxxp://www.videomarketingviral.com
hxxp://www.dominandocamtasia.com

What I can do? thanks

Ronald Vasquez

2

http://sitecheck.sucuri.net/results/www.videomarketingviral.com
http://zulu.zscaler.com/submission/show/56fa833d4460e68d4f3940079618084b-1335595565

http://sitecheck.sucuri.net/results/www.dominandocamtasia.com
http://zulu.zscaler.com/submission/show/3b791b3ad5fafd17c83228ec61b63a22-1335591929

3

Hi ronaldvasq,

I also see something here: ajax.googleapis dot com/ajax/libs/jquery/1.3.2/jquery.min.js?ver=1.3.2 benign
[nothing detected] (script) ajax.googleapis dot com/ajax/libs/jquery/1.3.2/jquery.min.js?ver=1.3.2
status: (referer=wXw.dominandocamtasia.com/)saved 57254 bytes 3dc9f7c2642efff4482e68c9d9df874bf98f5bcb
info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
info: [decodingLevel=0] found JavaScript
error: line:3: SyntaxError: invalid flag after regular expression:
error: line:3: filter(function(){return this.name&&!this.disabled&&(this.checked||/select|textarea/i.test(this.nodeName)||/text|hidden|password|search/i.test(this.type))}).map(function(E,F){var G=o(this).val();return G==null?null:o.isArray(G)?o.map(G,function(I,H){retur
error: line:3: ^
error: undefined function T.insertBefore
error: undefined variable T
suspicious
Then obfuscated packed code here: wXw.dominandocamtasia.com/wp-content/themes/OptimizePress/js/qtobject.js
translating into a check for content QuickTimePlayer plug-in code - “This content requires etc…” probably benign,

polonus

4

Thank you, my 2 websites are clean now, just to correct these problems.
http://sitecheck.sucuri.net/results/www.videomarketingviral.com
http://sitecheck.sucuri.net/results/www.dominandocamtasia.com

In the first web “videomarketingviral.com” I corrected the HTACCESS, there was the problem.

In the second web “dominandocamtasia.com” I updated Wordpress, I’ve also removed all suspicious files.

I hope that soon “Avast” remove me from their blacklist.

Ronald Vasquez

5

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles