Please exclude my site from the blacklist

Viruses and worms
1

The users of Avast anti-virus does not appear site http://www.vdcr.ru/
The program blocks access to the site, but actually multiple checks for viruses not identified.
I assume that the site inexplicably got in your black list.
To inform you that this site is the official site of the respected and respectable organization - public associations of entrepreneurs.
I will say more - the organization is an opposition in relation to the current Russian government and hope that the arrival of our site to the blacklist is not a political phenomenon.
Разрешить написание латиницей
The current situation has a very negative impact on the reputation of our organization.
I hope that all this apparent confusion, and soon you will assist in its resolution.

I offer my apologies for my English!

Sincerely,
Igor Khramov
Russia, Moscow

2

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles

3

Thank you - I wrote the link

4

Hi AlGarun,

Your site isn’t completely without issues, look here:
-www.ww.w.vdcr.ru/modules/amoney/js/jquery.js suspicious
[suspicious:2] (ipaddr:78.108.81.180) (script) -www.ww.w.vdcr.ru/modules/amoney/js/jquery.js
status: (referer=www.vdcr.ru/)saved 158407 bytes f02e1f7f1bb966d5fcf16b03daa79ee077a993f8
info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
info: [decodingLevel=0] found JavaScript
error: line:3: SyntaxError: missing ; before statement:
error: line:3: ; tags normally
error: line:3: …^
suspicious:
There is a history for the IP for malware: Heuristic.BehavesLike.JS.CodeUnfolding.C
This is the bad iFrame detecting report:

No zeroiframes detected!
Check took 11.85 seconds

(Level: 0) Url checked:
-http://www.vdcr.ru/
Google code detected (Ads, not a cheater)
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (iframe source)
-http://www.facebook.com/connect/connect.php?api_key=null&channel_url=/?fbc_channel=1&id=320781801289339&name=&width=250&locale=en_gb&connections=50&stream=0&logobar=0&css=
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
-http://static.ak.fbcdn.net/rsrc.php/v1/ym/r/5wi560vrdug.js
Blank page / could not connect
No ad codes identified

(Level: 2) Url checked: (script source)
-http://static.ak.fbcdn.net/rsrc.php/v1/yi/r/ugylnhvksfy.js
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru//media/system/js/mootools.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 2) Url checked: (script source)
-http://www.vdcr.ru//media/system/js/+src+
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru//media/system/js/caption.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru//plugins/content/ja_tabs/ja.tabs.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru//media/system/js/modal.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru/components/com_pollxt/script/json2.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru/components/com_pollxt/script/pollxt.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru//modules/mod_amoney/js/jquery.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)

Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru//components/com_acymailing/js/acymailing_module.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.vdcr.ru///mc.yandex.ru/resource/watch.js
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
htxp://traffstock.in/open/iframer.php?id=4717
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.google-analytics.com/urchin.js
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://counter.rambler.ru/top100.jcn?1053309
Blank page / could not connect
No ad codes identified

Also consider malware from here: http://www.google.com/safebrowsing/diagnostic?site=vkontakte.ru

polonus

5

Same thing is happening to our internal usage sites dl.qb9.net and vpn.qb9.net there is no report here look: http://www.google.com/safebrowsing/diagnostic?site=dl.qb9.net or http://www.google.com/safebrowsing/diagnostic?site=vpn.qb9.net please remove us. Just a message for each domain through your form.

Best,
Nicolás

6

If these are internal sites, then it may not be possible for some external scanners to see anything, but the difference with either the Network Shield (malicious site blocking, but that doesn’t appear to be what is alerting) or the Web Shield (real time scan of http traffic) would be able to access when visiting the pages.

e.g. http://sitecheck.sucuri.net/results/http://dl.qb9.net plus the google safe browsing hasn’t visited either site in at least 90 days.

Also see http://www.mywot.com/en/scorecard/qb9.net, whilst avast doesn’t use WOT it just shows that it isn’t alone.

So if there is a screen shot of the alert window it would give us more info, file name, location/url and malware name ?
If posting URLs to suspect sites please change http to hXXp to break links to avoid accidental exposure.

7

The response for Backdoor.Win32.Agent.tnr and Trojan-PSW.Win32.Agent.acbc that resided there is now dead.
Avast detected this as Win32:MalOb-JQ [Cryp],
malware was closed 2012-02-21, Zulu url risk analyzer gives it while it is being blacklisted yet: http://zulu.zscaler.com/submission/show/9e7d2e5bf1ea2276986797cab98cfab1-1332522281

polonus