Malware JS:ScriptIP-inf on www.parolecrociate.net ?

Viruses and worms
1

Hi,

Since yesterday, all my users who have Avast! installed can’t connect to my websites http://www.parolecrociate.net and http://forum.parolecrociate.net, while all the other users don’t have problems.

I think it’s a false positive, but Avast! tells:

A trojan horse was found!

File name: http://www.google.it/url?sa=t&rct=j&q=parolecrociate.net&source=web&cd=1&ved=0CB0QFjAA&url=http%3A%2F%2Fwww.parolecrociate.net%2F&ei=-ByhTrG2DoPh4QTLu6G9BA&usg=AFQjCNGqECOy4JA_MBT71d60ifoa5ZTdDA\http:\\www.google.it\url?sa=t&rct=j&q=parolecrociate.net&source=web&cd=1&ved=0CB0QFjAA&url=http%3A%2F%2Fwww.parolecrociate

Malware name: JS:ScriptIP-inf [Trj]

Malware type: Trojan Horse

VPS version: 111020-2, 20/10/2011

Here is the log:

21.10.2011 09:25:30 Network Shield: blocked access to malicious site dns://www.parolecrociate.net [ C:\Windows\system32\svchost.exe ]

Are there problems with your recent update?

Thanks in advance for the reply and support!!

2

VisusTotal is usless again ::slight_smile: so not able to scan the URL
Sucuri say clean

Wepawet report say Benign but is mentioning a redirect at the bottom
http://wepawet.iseclab.org/view.php?hash=22b444f3c47c624966cb7ee91e3bbf28&t=1319207852&type=js

3

Thanks a lot.
The redirect is from google ads… Is it possible this is a false positive? If yes, how can I unlock the website for my users? :frowning:

4

Hello,
it will be fixed in next VPS.

Milos

5

Thank you very much!!!

What should my users have to do, before the VSP, to connect to my websites without troubles?

6

i imagine next update is soon.

7

speak of the devil ;D i just updated now.

8

There has been no update yet, it is still on VPS 111021-0 and the network shield still blocks the site.

9

maybe its still blocked,but i did get my update just recently. 111021-0

10

Thank you very much for the quickness: PROBLEM SOLVED with your last update! :smiley:

11

Thanks for the feedback in reporting it resolved.