avast alert

[uddarts]

avast is tripping a malware alert here(pcper forums).

Infection Details
URL: http://www.mycloud-java.com/gate.php?v
Process: C:\Program Files\Mozilla Firefox\firefox...
Infection: URL:Mal

ud

[sttubs]

No alerts from Norton or Malwarebytes Pro for me. What is the specific alert?

[uddarts]

"network shield has blocked a harmful site."

does it with ie-8 also.

i think we had this happen awhile back.



ud

[modru2004]

im getting it too everytime a page here on pcper loads. it just started today.

[Insanatrix]

Same here though mine doesn't error out or anything it just won't let me on to the forums. Had to disable the realtime shield to be able to get on the forums.

[MrBlack]

Finally started getting Avast Alerts today on forums.pcper.com

Url:http://forums.pcper.com

Severity - High

Status:
Threat: HTML:Script-inf

Didn't have any alerts yesterday - so guess it is just certain ads

[MrBlack]

Still getting alert - updated to latest Avast defs
also tried latest beta pro-version

Like uddarts said - it seems to be the mycloud-java.com link
which sets off the alert

[uddarts]

i'm now getting resets and unable to display page. when i get a page, log in and try to post, i don't get the message box.



ud

[MrBlack]

So put in a question on the Avast Forum about it:
http://forum.avast.com/index.php?topic=100017.0

the answer was:
avast Networkshield flags as URL:Mal (a general detection for access to malicious sites that is being blocked)
Blocked because this is a declared scammer-account and avast still block site because of malware previously resided here:
htxp://www.mycloud-java.com/gate.php?v=361 (found detections for that malware elsewhere and recently reported here)
This malware for this domain has been dead since 2012-06-22 04:31:04, that is why we now will get a "HTTP/1.1 403 Forbidden" (provided by hoster),
avast still blocks via Networkshield, that is why avast is still blocking this site,

polonus

[MrBlack]

ps..I'm still not sure if safe or not
but feel a lot better browsing pcper with linux

[MrBlack]

uh oh - followup

And there is more...
This was the related spammer for that IP
maltibbies AT hotmail dot com (search) La Place, La 184.82.172.2 SM*LL SIZE M A L T E S E P * P P I E S
These scams are pre-texts to infect with malware (e.g. Zeus)
We also had this launched from: htxp://www.jscript-cloud.com/gate.php?v=384 as for htxp://www.jscript-cloud.com/gate.php?v=361
So that malcode was continuously being launched from 184.82.172.2
That was the purpose of that malcode scam campaign, now being halted in its tracks,

polonus

[MrBlack]

Well in the end...

appears to be a result of user tracking by quantserve
no big deal (to me anyway)


http://forum.avast.com/index.php?topic=100017.0

[uddarts]

this is what i'm seeing today.

Infection Details
URL: http://forums.pcper.com/
Process: C:\Program Files\Mozilla Firefox\firefox...
Infection: HTML:Script-inf

ud

[The Wise One]

thanks for the info everyone. we are looking into it.

[Ryan]

Interesting, thanks for helping to do some research on this for us.

Quantcast is near industry standard application used for tracking site statistics, kind of like Google Analytics, that allows to compile data to give to potential advertisers. Basically, it validates our traffic claims, etc.

I am going to have Wise update the code on the site to see if that helps fix this.