URL:Mal на сайте

Добрый день.

На сайт перестало пускать с компьютеров на которых установлен аваст, ругается на URL:Mal и блокирует доступ.
Сайт проверялся онлайн утилитами, а так же выкачивался и проверялся локально разными антивирусами в том числе и авастом. Аваст обнаружил 3 вредоносных файла с расширением .pdf, которые в свою очередь были удалены с сайта, но проблема не решилась.
С компьютеров на которых установлены другие антивирусы пускает без проблем, также инфицированные pdf файлы отправлялись на проверку в virustotal и из нескольких десятков антивирусных баз только аваст забраковал их.
Что нужно сделать чтоб avast не ругался на сайт?

Non-english zone > https://forum.avast.com/index.php?board=21.0

what URL do you have problems with?

post link to Virustotal scan result

www.doctor-roshal.ru

Blacklisted
https://www.virustotal.com/en/url/7a2e640c37b4e03b722ba16ce5907372ed3f59824b3d08712397f1b9b926aef4/analysis/1477578514/

IP history > https://virustotal.com/nb/ip-address/194.58.97.81/information/

Blacklisted > http://www.urlvoid.com/scan/doctor-roshal.ru/

hpHosts list it as EMD > http://hosts-file.net/?s=doctor-roshal.ru

[b]EMD - Sites engaged in malware distribution[/b] This classification is assigned to website's engaged in the distribution of malware (e.g. adware, spyware, trojans and viruses etc).

Sites with this classification typically either contain files (e.g. cracks, keygens, adware, spyware, trojans, viruses et al) or lead to such via (for example) “fake scanners” or other social engineering and misleading tactics. This includes the activities of rogue Internet Service Providers (ISPs) that host other sites to which the EMD classification applies.

Suspicious > http://www.UnmaskParasites.com/security-report/?page=www.doctor-roshal.ru

urlQuery > http://urlquery.net/report.php?id=1477579116898

HTML scan > https://virustotal.com/nb/file/0feb4bb10d5e40a828124c45c9f353347ac0cbdb81533e70e0d86c7504289db8/analysis/1477579391/

Спасибо, будем лечить.

Vulnerable library :
http://retire.insecurity.today/#!/scan/c4e0f05abeef3836a58c598cb4f835c689706f5bbf31bb96ff2b48adfb89cf53

Malicious :
https://www.virustotal.com/en/url/7a2e640c37b4e03b722ba16ce5907372ed3f59824b3d08712397f1b9b926aef4/analysis/1477581078/

Blacklisted :
https://sitecheck.sucuri.net/results/www.doctor-roshal.ru

Blacklisted and (possible) links to blacklisted sites :
https://www.websicherheit.at/website-malware-viren-scanner/?url=www.doctor-roshal.ru

Blacklisted and spreading malware :
http://urlquery.net/report.php?id=1477581188493

Bad IP history :
https://www.virustotal.com/en/ip-address/194.58.97.81/information/

At least suspicious :
http://zulu.zscaler.com/submission/show/a7dfaf1c32fa4d959609fcddf82130cf-1477581117

Hi Aleksey3303,

Your website is alerted via Google Safe Browsing:
This site is currently not listed as suspicious by Google, only maybe an older McAfee SiteAdvisor alert,
also Yandex and DrWeb see it as clean and PhishTank. Bitdefender, ESET and Fortinet alert.

A javascript check comes up as suspicious.

Please check this list for unknown links on your website:

-http://www.mosgorzdrav.ru/ → ‘’
-https://www.rosminzdrav.ru/polls/9-anketa-dlya-otsenki-kache → ‘’
-http://www.roshalfund.com/ → ‘’
-http://www.centr-bdd.ru/home.html → ‘’
-http://www.spas-extreme.ru/ → ‘’
-http://sopdu.org → ’ ’
-http://sopdu.org → ’ разработка и�’
-http://sopdu.org → ‘интернет-лабора�’

Redirecting link found: URLs that redirect found in: -http://www.doctor-roshal.ru/

1: -http://operaphone.net/u/1658 → -http://www.opera.com/mobile//u/1658

See recent IDS alerts here: http://urlquery.net/report.php?id=1477588912692

jQuery code to be retired: http://retire.insecurity.today/#!/scan/df40c4d4d65f058248a67bffba601b9e18ee943c63694c003d24505a2d2b09e8

See “new wave javascript” with sources and sinks: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fwww.doctor-roshal.ru

A-Status OK - https://sritest.io/#report/5301921e-3e63-4e29-8db6-e1e51e4daa5d
F-Status here: https://observatory.mozilla.org/analyze.html?host=www.doctor-roshal.ru

So try to get rid of the blacklisting status and enhance website security as presented to you,

Pozdrawiam, всего́ до́брого

polonus (volunteer website security analyst and website error-hunter)

Locky infection here a couple of days ago: doctor-roshal[.]ru/drqxbtg
Heal it, update everything vulnerable others pointed out, then we will see :wink: