Web Shield FP? -> Solved

Viruses and worms
1

Avast Free v8 Web Shield has recently begun alerting on www.sweetmarias.com with:

7/30/2014 1:14:43 PM http://www.sweetmarias.com/store/|>{gzip} [L] JS:ScriptIP-inf [Trj] (0)

I’ve run the page through Securi SiteCheck and virustotal and it comes up clean. Defs version 140729-0

Thanks for any help.

2

You are using a real old avast version.
Update to the newest one then check again.

3

VirusTotal
https://www.virustotal.com/en/file/c1a15a37b443daf5c546cb11edf0b452b69138d9d87e181788120ca736c5c6bd/analysis/1406754318/

4

Hello, there is javascript function called “timedCount()” that does not seems too legit.
This function collects informations from shipping/registration form and send them to internet every 40 miliseconds.

5

Thanks for checking that. When I made the site owner aware of the alert 2 days ago, he said he was referring it to his “IT guy.”

And I’m still getting the alert after updating to Avast v9.

6

Thanks for the help Tondah. The site has been fixed and the owner tight-lipped as to whether is was sloppy code or injection. Nothing but Avast found it.