Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

In a recent question I asked about investigating websites for viruses.

The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, then used it on a website we suspected and it came up with 'Potential Active Threats'(link to the report).

My organization represents Sheep Farmers in Ontario and if this website is a serious we need to report it.

However I need to know before hand, how credible is the Potential Active Threat alert from AVG? They seem like a credible company and the analysis even lists the potential threats(Blackhole Exploit Kit, and Javasript Obfuscation). I don't want to come out with a warning about the website for our Farmers and have it back fire if there really isn't a threat.

share|improve this question
Just to point out: I didn't read / register in my brain the part where you said that your site is clean, but another site is the one coming back as infected. If your site is clean, you do not have to nuke your server. The other site needs to review their system, though. – Jeff Ferland♦ May 1 '12 at 17:21
I figured you had missed that bit from your response, but the first part of your answer was all I needed. We are contacting the owner of the website, if they do not act we will have to go public with the information. – PhilipK May 1 '12 at 17:23

2 Answers

up vote 5 down vote accepted

I generally consider AVG to be reputable. When in doubt, you can always check against other scanning sites as well.

I don't know what to make of the "Javascript obfuscation" threat, but the Blackhole Exploit Kit is a clear sign of compromise.

Now, for the really bad news: The infected site is going to have to nuke their web server from orbit. Read the whole answer linked there, but the key thing is the only way to be certain that you've got control of the system is to rebuild the system.

share|improve this answer
Do make sure you confirm the positive results. It is possible, for instance, that it shows a 'threat' because a port was open. – schroeder May 1 '12 at 15:45
I don't think the OP was indicating that his organization's central server was compromised. Feel free to correct me if I'm wrong, but I believe his concern is that a third-party site (which his users view on a regular basis) may be compromised. Presumably, he would like to issue an advisory on his organization's website. If this is true, and the malware is in fact coming from the third-party site, his central server does not need to be wiped. – Jared Ng May 1 '12 at 16:15
@JaredNg You have to look to the background question the asker linked; it isn't clear unless you read that question too. – Jeff Ferland♦ May 1 '12 at 16:22
@Jeff I did see that other question. But see the following statement from this question: > First I used it on our website and found it was clean, then used it on a website we suspected and it came up with 'Potential Active Threats'(link to the report). Edit: I should add that what I mean is: the previous question was "Is the source of the infection my website or a third-party site?", while this question is "I ran AVG on my site and it was clean, but I ran it on a third-party site and it's not -- how reputable is AVG?" – Jared Ng May 1 '12 at 16:31
Ah, crap... I didn't read that one through. – Jeff Ferland♦ May 1 '12 at 17:19
up vote 3 down vote

"Javascript Obfuscation" is where your site is vulnerable to having obfuscated javascript run because your filters do not account for it. This does not mean that you have a problem, just that there is a possibility of a problem. Look at OWASP for libraries that you can use to combat this problem.

"Blackhole" is a resulting infection from Javascript Obfuscation. More details here so you can confirm the infection.

I'd want to run another scanner on your site to confirm and look for other issues.

If you do have this exploit kit, then Jeff Ferland's advice on a nuke from orbit is your next step.

I'd also recommend separating your website from your main server so that you limit the damage that this type of infection can create.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.