Strange url:mal for several of my sites

Viruses and worms
1

Hello all,

I have seen such error before, and always assumed that it was accurate, but this time it’s for some of my sites and I am pretty sure that it’s a false positive. At first I didn’t think much of it, but then my traffic dropped, so I would like to see if we can get it fixed.

One of the affected sites is hxtp://www.acnesolutionsthatwork.com

Let me know if you can figure out what the problem is - I really couldn’t so I would appreciate any advice!

Thank you!

2

and what warning do you get from avast…can you attach a screenshot ?

Sucuri:
http://sitecheck.sucuri.net/results/http://www.acnesolutionsthatwork.com

Wepawet
http://wepawet.iseclab.org/view.php?hash=66970ad0e3a0480bb5951aa20fc2b233&t=1328248654&type=js

urlQuery - suspicious
http://urlquery.net/report.php?id=18994

3

plaese chance the url so it can’t be clicked on. chance it to wxw or something.

4

Yes, make that url non-click through. Suspicious code: -s.ytimg.com/yt/jsbin/www-module-vflyEJLff.js suspicious
[suspicious:2] (ipaddr:74.125.227.142) (script) -s.ytimg.com/yt/jsbin/www-module-vflyEJLff.js
status: (referer=-www.youtube.com/embed/dEUqlQ_HlW8)saved 83245 bytes c67e14493e7f639e20add4d613a7d8cc18fa5434
info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
info: [decodingLevel=0] found JavaScript
info: [decodingLevel=1] found JavaScript
suspicious:

polonus

5

Sorry for the late reply all. I was still trying to figure it out myself…

Pondus: I see that urlQuery lists the site as suspicious, but I don’t understand why? Does it say that anywhere? I would attach the screenshot but it really won’t help… all it says is URL:Mal.

Polonus: Are you saying that the YouTube video is what’s causing this? If so, how is that possible (all I did was to copy/paste the embedded video), and would removing the video be the only way to solve the issue?

Update: This specific site is no longer being blocked. At first I assumed that it was a bug that had been corrected, since I didn’t take any action, but then I realized that the rest of my sites were still being blocked. I could list them all here, but I would much rather keep the URLs private. These sites are all build through Wordpress and are very similar, so any ideas that you may have based on the site in the thread would apply to all. Please help.

6

Hello,
can you send us the rest of blocked sites please? Send it to “virus at avast . com”
Regards,
Jan Sirmer