Threat Detected False Positive for URL

[system]

I had some malware on a site I manage. Avast reported “Threat Detected”. Since I cleaned the site and re-submitted the site to Google, Avast still flags the site as having malware.

I’ve checked the site via online site checkers; they all report the site as clean, as does Google.

What is the problem with Avast?!

Site: http://train2speak.com

Screen Grabs:
https://www.box.com/s/v9auikt9gr4flk918wxb
https://www.box.com/s/f65tigw89q3qosxjdga9
https://www.box.com/s/09o69m4smixtykdx8gds

TIA

Flash Buddy

[Pondus]

avast does not say infected… but URL:mal. meaning it is on a block list

also if you look at the avast warning, the alert is not on the Exact same URL as you posted…
what do you get if you click the more details button?

[DavidR]

There appears to be more than one domain name on that IP address, so it is possible this is an IP block rather than a block on the domain name.

URLVoid shows this domain as clear but another domain on that IP as being infected, http://www.urlvoid.com/scan/train2speak.com/.

Sucuri.net also shows that the wordpress version is out of date and this leaves the site more vulnerable to exploit, http://sitecheck.sucuri.net/results/train2speak.com/. This is something that you need to address.

###
There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for: * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Undetected Malware; Press (Media), issues.

• If you are reporting an FP, then you get another input field open, click Browse button and navigate to the file or enter the web URL for the site you wish to submit for review (Network Shield - IP address), etc. A link to this topic also wouldn’t hurt.

[Pondus]

and the other domain has this result at sucuri.
http://sitecheck.sucuri.net/results/isleoffantasia.com/
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=isleoffantasia.com

[system]

I don’t get much:
https://www.box.com/s/cxlk1eqcf6p0sl9kpj1s

@Pondus post:2

avast does not say infected… but URL:mal. meaning it is on a block list

also if you look at the avast warning, the alert is not on the Exact same URL as you posted…
what do you get if you click the more details button?

[system]

Great catch. I removed the malware, then suspended the account and modified the dns to park the domain. I wonder how long it will take Google to catch up?

@DavidR post:3

There appears to be more than one domain name on that IP address, so it is possible this is an IP block rather than a block on the domain name.

URLVoid shows this domain as clear but another domain on that IP as being infected, http://www.urlvoid.com/scan/train2speak.com/.

Sucuri.net also shows that the wordpress version is out of date and this leaves the site more vulnerable to exploit, http://sitecheck.sucuri.net/results/train2speak.com/. This is something that you need to address.

###
There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for: * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Undetected Malware; Press (Media), issues.

• If you are reporting an FP, then you get another input field open, click Browse button and navigate to the file or enter the web URL for the site you wish to submit for review (Network Shield - IP address), etc. A link to this topic also wouldn’t hurt.

[DavidR]

Well the problem you need to worry about is the avast block not google that is why I suggested reporting it so the IP block can be changed to a domain name block of the infected domain, effectively releasing the train2speak.com domain.