Wah: Avast's Blacklisting a Clean site

Viruses and worms
1

The site I’m talking about had a problem some time ago, it was cleaned quickly but is still suffering being in the blacklist.

Could you exclude the site from avast’s blacklist?
The site is http://wahackpokemon.com

G-Data send me this info:

I just received word from one of our analysts that this was indeed a false positive detection, the reason being that back in March 2011 a variant of the ZEUS Trojan was parked there. That has been removed by now but for some reason the website was still blacklisted.

This blacklist entry is now scheduled for removal – the website should be available again within the next few hours.

It’s clean in http://www.urlvoid.com
In virusTotal is also clean, (except for websense who until now didnt give any support all this time)
In unmaskparasites : This page seems to be

2

Sucuri Scanner say infected
http://sucuri.net/malware/malware-entry-mwdefaced01

Malware found in the URL: hxxp://wahackpokemon.com/es/mirage-space
Malware found in the URL: hxxp://wahackpokemon.com/es/lightplatinum-space

3

Hi ser123,

Make that link non-click through like -http://wahackpokemon.com/ or like Pondus did hxxp://wahackpokemon.com/
We have to re-evaluate…

WOT has questions on the vendor reliability and privacy scores of the site:
http://www.mywot.com/en/scorecard/wahackpokemon.com
The link to -www.megaupload.com is flagged by unmasked parasites
and also the link here: http://www.google.com/safebrowsing/diagnostic?site=www.mediafire.com

Do not know about the actuality of these defacements as mentioned by sucuri ?
Cannot trace them now when I visited site via a proxy just a minute ago…
SOSWebScan says: Your site URL -http://wahackpokemon.com/ has been successfully scanned. And No Malware or badwares found.

Anyway the server there gives away too much information about installed version etc., specific header information about dynamically generated content should not be given away, and the site uses Flash with the danger of local shared object cookies,

polonus

4

NORMAN analysis say infected

wahackpokemon.com.htm : Processed - HTML/Agent.MV
5

urlvoid, avg and others say “can’t find the location”, “can’t scan” and such things as I write this.

Name of the site doesn’t sound trustfull to me.

6

I really doubt if this site is clean.
Unfortunately,i can see this site listed here(10 before the end of the list) as rogue site, http://www.freepcsecurity.co.uk/2010/10/04/malicious-sites-october-04/. In addition,in the past this site was listed by Zeustracker.

Urlvoid can’t scan this site since the domain “does not exist or is unaccessible”.Refence to your post(It’s clean in http://www.urlvoid.com).

7

Hello,
i checked this site and it is clear now, and it was removed from Zeustracker. It will be removed from our black list in next VPS.

8

I got a feeling it is clear for as long as it lasts. Which will be not be long.