website being blocked. False positive?

Viruses and worms
1

One of my websites is being blocked by Avast (http :// eisabainyo.net/) Could it be a false positive? Can anyone have a look at it and let me know because I have looked at the source code and there’s no iframe injection except for google ads with iframe code.

Thank you.

2

Generator: WordPress 2.7.1 - Warning: Old version of WordPress. It may be vulnerable. Please upgrade.

What happened when Google visited this site?

Of the 3 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-17, and the last time suspicious content was found on this site was on 2009-08-28.

Malicious software includes 39 exploit(s).

This site was hosted on 1 network(s) including AS31727 (NODE4).

Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 2 domain(s), including filmizlemek.org/, ytporn.com/.

This was pulled from : http://www.google.com/safebrowsing/diagnostic?site=eisabainyo.net

Also there is this : http://www.mywot.com/en/scorecard/eisabainyo.net

3

It is being blocked by the network shield’s malicious sites list.

avast isn’t alone on that regard, see http://wepawet.cs.ucsb.edu/view.php?hash=e81247efce6bd04354c676bf0c42f0b3&t=1251260345&type=js

Have you had a recent infection on the site, that is usually how these things get added ?

However, having bypassed the network shield I get no alert by the web shield, but I found this page, hXXp://eisabainyo.net/weblog/2009/04/06/iframe-injection-attack/ (note how the link is broken with the hXXP) now in the example on that page (see image) it may be what caused this I don’t really know, but it may be better to use an image to show the example rather than the text you have.

That said you can send an email to virus (at) avast (dot) com, with a link to this topic might help and false positive - network shield in the subject.

4

Thanks very much, DarkLegend. The reports were helpful.

I am going to update WP and change hosting company.

5

Thanks for your explanation, DavidR. I did have an iframe injection attack a few months ago but I had removed all the affected files and restored the clean version.

I’ll contact Avast to see if they could remove the domain from the malicious websites list.

6

You’re welcome, good luck.

7

No problem, Glad I could be of help :smiley: