Website listed by avast as infected (it isn't) and no reply from avast

Viruses and worms
1

I am the webmaster for a very busy support website for supporting families touched by addiction. For several weeks Avast members have not been able to get on the website or register. Soon they will be having a big increase in registrations but any folks with avast cannot access the website.

WEBSITE URL: hxtp://www.learn2cope.org/

I have requested that this website be removed from the Avast blocklist but I have not received replies to either of my requests. My client is incredibly frustrated, any help or suggestions you can offer would be most appreciated.

Thank you!

  • Kat von Tungeln
    Webmaster of hxtp://www.learn2cope.org/
2

Hello,

your website is infected with Javascript Malware: http://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fwww.learn2cope.org%2F

3
  1. Make the links not clickable.
  2. Clean the site thoroughly. The website is heavily infected with SEO Spam.
  3. Than ask avast to allow it.

http://sitecheck3.sucuri.net/results/www.learn2cope.org
https://www.virustotal.com/en/url/4de5f7d7f39e8ac8e07578bc22399aff932d26d231e42e7574c467c17388387c/analysis/1395081760/
http://zulu.zscaler.com/submission/show/8c8246d5eb0c7344a4f4f25d55dce084-1395081746

The website also contains a hidden IFrame which is always suspicious.

4

Steven & Eddy are right there, also IFrame check came up with: Suspicious

htxp://cvp.telvue.com/player?id=t01133&video=57532&mini=1’

Blackhat SEO Spam detected!

See issues detected here: http://sitecheck2.sucuri.net/results/www.learn2cope.org/
see for instance here: http://jsunpack.jeek.org/?report=c558bb576e72a897f1db4d0ae78354249b0e31d7

polonus

5

VirusTotal
https://www.virustotal.com/en/file/78b2d40c6e3710326bcf8613445c44523467a43284077a9eaf6517b8fbff2660/analysis/1395083403/

SEO spam http://blog.sucuri.net/tag/spam

6

We had already removed the googlebot outdated code and took out the old sIFR that the old webmaster used.

Can you do an uncached scan?

Thank you. How do we get avast to remove the site?

7
Thank you. How do we get avast to remove the site?
It is not just avast...... see my post above

EDIT: if you just removed that code?..sucuri say clean now http://sitecheck3.sucuri.net/

8

The links I posted are un-cached scans and I did them just several minutes before posting here.

Only way to have avast allow the website is following the instructions I gave you in my previous post.

And again, make the links not clickable.
We don’t want people to visit a infected website.

9

Links reportdd to be broken

10

Hello,
nothing detected, screenshot of avast!'s alert window needed. And IP address of resolved domain.

Milos

11

http://dnscheck.pingdom.com/?domain=www.learn2cope.org
http://www.domxssscanner.com/scan?url=http%3A%2F%2F198.57.167.73
http://multirbl.valli.org/lookup/198.57.167.73.html
IP: 198.57.167.73

12

Hi Eddy,

You worked that server to get over his server quota: domxssscanner.com
Here I get an all green: http://multirbl.valli.org/lookup/198.57.167.73.html
And indeed I get the same nameserver problems as you got:
http://dnscheck.pingdom.com/?domain=www.learn2cope.org&timestamp=1395098035&view=1
This is not particularly adding to IP security there: http://sameid.net/ip/198.57.167.73/
and could soon lead to a general IP detection.
For that IP I see no actual of historical threats with ThreatSTOP results.
Historical badness of AS: http://sitevet.com/db/asn/AS46606
Not blacklisted here as far as we know: http://www.ipvoid.com/scan/198.57.167.73/

polonus

Update there is …… in the code, which translates to Index: #8230;… Anyone?

D