[Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen]

Hello. I would like to give you guys some feedback.

It seems that i've figured out what is going on.

The website is actually infected by the Trojan.Script.Balada.gen. Today the Kaspersky allowed to access the website once, but prevented a redirection to a malicious website (soft . specialcraftbox . com). After that I was able to find this article reporting a flaw in a Plug-In that I use for Pop-up - Thousands of Sites with Popup Builder Compromised by Balada Injector (sucuri.net)

 

Thanks for all the assistance.

[Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen]

1 hour ago, Berny disse:

@Gabriel Ferreira

I checked some WP Java Scripts that came out clean 🤔,  did you check JS codes  on your side ?
Only Kaspersky Virus Lab can handle this issue.

I've checked everything that I could on my side.
Let's wait for the Kaspersky Virus Lab answer. Thank you!

[Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen]

1 hora atrás, harlan4096 disse:

Weird, still being infected:

 

 

But:

 

 

I can't figure out what is going on. Already run several anti-malware WordPress' plug-ins and all came clean. Asked one of then to do a manual check-up and they assured that was clean. Also the online websites scans can't find anything. 

However, Kaspersky keeps telling that it's infected and I don't know how to fix it 😥

[Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen]

15 hours ago, harlan4096 said:

Still offline here...

Oh I'm sorry, there was a typo in the address. The correct one is:

Https:// www . otorrinojoinville . com . br

Thanks!

[Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen]

30 minutes ago, harlan4096 disse:

 

I can't access to that site, it seems currently down...

I was restoring an old backup hoping to fix issue, but with no luck. It's currently online now.

[Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen]

23 horas atrás, Guilhermesene4096 disse:

@Gabriel Ferreirae @ian mendes

Just some feedback:

Unfortunately, Kaspersky Virus Lab is taking longer than usual to respond.

I'll get back to you as soon as I have an answer 👍

Hello @Guilhermesene4096. Any news?

 

Thank you!

[Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen]

Hello,

 

I have the same issue with my site with the very same alert (HEUR:Trojan.Script.Balada.gen). However, I've run several anti-malware tools and checked on online scans and everything is clean.

@Guilhermesene4096 Could you please verify mine too?

https :// www.otorrinojoinvile.com.br

 

Thanks