Web Shield FP? -> Solved

mbrowne999 · 2014-07-30T20:45:41.000Z

Avast Free v8 Web Shield has recently begun alerting on www.sweetmarias.com with:

7/30/2014 1:14:43 PM http://www.sweetmarias.com/store/|>{gzip} [L] JS:ScriptIP-inf [Trj] (0)

I’ve run the page through Securi SiteCheck and virustotal and it comes up clean. Defs version 140729-0

Thanks for any help.

Eddy · 2014-07-30T20:47:04.000Z

You are using a real old avast version.
Update to the newest one then check again.

Pondus · 2014-07-30T21:06:35.000Z

VirusTotal
https://www.virustotal.com/en/file/c1a15a37b443daf5c546cb11edf0b452b69138d9d87e181788120ca736c5c6bd/analysis/1406754318/

Tondah · 2014-07-31T08:03:13.000Z

Hello, there is javascript function called “timedCount()” that does not seems too legit.
This function collects informations from shipping/registration form and send them to internet every 40 miliseconds.

mbrowne999 · 2014-07-31T16:52:53.000Z

Tondah post:4:

Hello, there is javascript function called “timedCount()” that does not seems too legit.
This function collects informations from shipping/registration form and send them to internet every 40 miliseconds.

Thanks for checking that. When I made the site owner aware of the alert 2 days ago, he said he was referring it to his “IT guy.”

And I’m still getting the alert after updating to Avast v9.

mbrowne999 · 2014-08-02T17:38:08.000Z

Thanks for the help Tondah. The site has been fixed and the owner tight-lipped as to whether is was sloppy code or injection. Nothing but Avast found it.

Announcements