Jump to content
Kaspersky Support Forum

Is my company's website truly infected? HEUR:Trojan.Script.Balada.gen

ian mendes

By ian mendes
in Virus and Ransomware related questions

 Share
Go to solution Solved by Guilhermesene4096,

Recommended Posts

ian mendes

ian mendes

Posted
Posted (edited)

Hello!
My organisation is getting the following warning while trying to acces our domain:
object is infected HEUR: TROJAN.Script.Balada.gen
I've submitted the address on the web address analysis and it came out clean.
Is it a false detection?
The domain is linked https : //cremern.org.br/

infected.png

Edited by Berny
Suspicous link disabled !
Guilhermesene4096

Guilhermesene4096

Posted
Posted
@ian mendes Welcome
 
I have sent your URL to Kaspersky Virus Lab and will provide the verdict when available.
 
The analysis may take a few hours or days (normally it doesn't take long), so I ask that you please wait.
 
If it is considered a false positive, it will be removed from detection in the next update of your Kaspersky product.
  • Like 2
Gabriel Ferreira

Gabriel Ferreira

Posted
Posted (edited)

Hello,

 

I have the same issue with my site with the very same alert (HEUR:Trojan.Script.Balada.gen). However, I've run several anti-malware tools and checked on online scans and everything is clean.

@Guilhermesene4096 Could you please verify mine too?

https :// www.otorrinojoinvile.com.br

 

Thanks

Edited by Berny
Guilhermesene4096

Guilhermesene4096

Posted
Posted

@Gabriel FerreiraWelcome

At first glance the site looks clean, however, let's wait for a final verdict.

I have sent your URL to Kaspersky Virus Lab and will provide the verdict when available.
 
The analysis may take a few hours or days (normally it doesn't take long), so I ask that you please wait.
 
If it is considered a false positive, it will be removed from detection in the next update of your Kaspersky product.
  • Like 1
Guilhermesene4096

Guilhermesene4096

Posted
Posted

@Gabriel Ferreirae @ian mendes

Just some feedback:

Unfortunately, Kaspersky Virus Lab is taking longer than usual to respond.

I'll get back to you as soon as I have an answer 👍

  • Like 1
Gabriel Ferreira

Gabriel Ferreira

Posted
Posted
23 horas atrás, Guilhermesene4096 disse:

@Gabriel Ferreirae @ian mendes

Just some feedback:

Unfortunately, Kaspersky Virus Lab is taking longer than usual to respond.

I'll get back to you as soon as I have an answer 👍

Hello @Guilhermesene4096. Any news?

 

Thank you!

Guilhermesene4096

Guilhermesene4096

Posted
Posted

@Gabriel Ferreira

Unfortunately, still no return from KVL 😌

This time they are taking a while to respond

I'll try reporting your URL to them again and get back to you as soon as I hear back 👍

  • Like 1
  • Solution
Guilhermesene4096

Guilhermesene4096

Posted
  • Solution
Posted

@ian mendes

⚠️ Final verdict from Kaspersky Virus Lab ↓
Quote

"Hello,

Thank you for waiting.

As previously reported, the website in question 'cremern.org.br' is not listed as a threat to Kaspersky, so the message may have occurred because the client is on an outdated version of Kaspersky.

Ask the user to update their version of Kaspersky and the database."

 

  • Like 2
harlan4096

harlan4096

Posted
Posted
Quote

https :// www.otorrinojoinvile.com.br

 

I can't access to that site, it seems currently down...

  • Like 2
Gabriel Ferreira

Gabriel Ferreira

Posted
Posted
30 minutes ago, harlan4096 disse:

 

I can't access to that site, it seems currently down...

I was restoring an old backup hoping to fix issue, but with no luck. It's currently online now.

harlan4096

harlan4096

Posted
Posted

Still offline here...

ian mendes

ian mendes

Posted
  • Author
Posted
8 horas atrás, Guilhermesene4096 disse:

@ian mendes

⚠️ Final verdict from Kaspersky Virus Lab ↓

 

Thank you, Guilherme !

  • Like 1
Gabriel Ferreira

Gabriel Ferreira

Posted
Posted
15 hours ago, harlan4096 said:

Still offline here...

Oh I'm sorry, there was a typo in the address. The correct one is:

Https:// www . otorrinojoinville . com . br

Thanks!

  • Thanks 1
harlan4096

harlan4096

Posted
Posted

Weird, still being infected:

 

imagen.thumb.png.38e57291d81fb07b3c56e2d5b34250e5.png

 

But:

 

imagen.thumb.png.3eb5baf44dcf39a255a9029846672f0c.png

 

imagen.thumb.png.eb101dd9af7ad5558eb720c332dbb60c.png

  • Like 3
Flood and Flood's wife

Flood and Flood's wife

Posted
Posted (edited)

Hi @harlan4096, 

Confirmed:

USER_2024-02-07_195044.thumb.jpg.1d31455d9aae90cec86f08d4bfe6244b.jpg

 

USER_2024-02-07_195334.thumb.jpg.b9074b88a7e839e3808936d5d4416ac9.jpg


Thank you🙏
Flood🐳+🐋

Edited by Flood and Flood's wife
pn
  • Like 1
Gabriel Ferreira

Gabriel Ferreira

Posted
Posted
1 hora atrás, harlan4096 disse:

Weird, still being infected:

 

imagen.thumb.png.38e57291d81fb07b3c56e2d5b34250e5.png

 

But:

 

imagen.thumb.png.3eb5baf44dcf39a255a9029846672f0c.png

 

imagen.thumb.png.eb101dd9af7ad5558eb720c332dbb60c.png

I can't figure out what is going on. Already run several anti-malware WordPress' plug-ins and all came clean. Asked one of then to do a manual check-up and they assured that was clean. Also the online websites scans can't find anything. 

However, Kaspersky keeps telling that it's infected and I don't know how to fix it 😥

Berny

Berny

Posted
Posted

@Gabriel Ferreira

I checked some WP Java Scripts that came out clean 🤔,  did you check JS codes  on your side ?
Only Kaspersky Virus Lab can handle this issue.

Gabriel Ferreira

Gabriel Ferreira

Posted
Posted
1 hour ago, Berny disse:

@Gabriel Ferreira

I checked some WP Java Scripts that came out clean 🤔,  did you check JS codes  on your side ?
Only Kaspersky Virus Lab can handle this issue.

I've checked everything that I could on my side.
Let's wait for the Kaspersky Virus Lab answer. Thank you!

  • Like 1
harlan4096

harlan4096

Posted
Posted

Ok, it seems here is it not detected anymore:

 

imagen.thumb.png.fca03fc8ed6e835f77d40838632d7579.png

  • Like 1
Gabriel Ferreira

Gabriel Ferreira

Posted
Posted

Hello. I would like to give you guys some feedback.

It seems that i've figured out what is going on.

The website is actually infected by the Trojan.Script.Balada.gen. Today the Kaspersky allowed to access the website once, but prevented a redirection to a malicious website (soft . specialcraftbox . com). After that I was able to find this article reporting a flaw in a Plug-In that I use for Pop-up - Thousands of Sites with Popup Builder Compromised by Balada Injector (sucuri.net)

 

Thanks for all the assistance.

  • Like 4
Guilhermesene4096

Guilhermesene4096

Posted
Posted

@Gabriel Ferreira

Similar topics may appear here in the community about this

Thanks for your feedback 👍

  • Like 1
  • 3 weeks later...
AndrewL

AndrewL

Posted
Posted

Hello! I just saw this "HEUR:Trojan.Script.Balada.gen" message as well with this site:

https:// padreguillermo . com

Virustotal detects nothing.

Thanks!!

 

 

Guilhermesene4096

Guilhermesene4096

Posted
Posted
@AndrewLWelcome back
 
I have sent your URL to Kaspersky Virus Lab and will provide the verdict when and if available.
 
The analysis may take a few hours or days (normally it doesn't take long), so I ask that you please wait.
 
If it is considered a false positive, it will be removed from detection in the next update of your Kaspersky product.
  • Like 3
  • 2 weeks later...
AndrewL

AndrewL

Posted
Posted
On 2/23/2024 at 4:48 PM, Guilhermesene4096 said:
@AndrewLWelcome back
 
I have sent your URL to Kaspersky Virus Lab and will provide the verdict when and if available.
 
The analysis may take a few hours or days (normally it doesn't take long), so I ask that you please wait.
 

Thanks, Guilherme. Should I still wait? The site is still being detected.

Guilhermesene4096

Guilhermesene4096

Posted
Posted

@AndrewL

Unfortunately, yes, I have not yet received a response from KVL.

I am forwarding the request to the Kaspersky Virus Lab analysis team and will get back to you as soon as I have feedback.

  • Like 3

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
 Share
Go to topic listing


×
×
  • Create New...