My Website is getting considered as malware!

[Bruno D]

Hi!

Recently lots of people are getting blocked from my site because they receive a warning saying:

Quote

 

Prevented downloading of a dangerous object
Prevented downloading of a malicious file or other object designed to infect your computer with malware that will slow it down, break the system or lead to other problems.

You were protected from downloading this object by Kaspersky security. You can close this window with no risk.

Hide details

Detected: 03/10/2023 14:08:12

Web address: https:// squared-potato . pt/

Reason: object is infected HEUR:Trojan.Script.Generic

 

 

Is this a fake positive? I already tried using virus total and contacting my webhost and all of them say that everything is ok.

Thanks in advance!

[harlan4096]

Welcome to Kaspersky Community.

 

https://www.virustotal.com/gui/url/97246bb5896d14fa634aee5d88a05539547f0367d01e84d2ed09ad8535e19789?nocache=1

 

 

I've just reported it to K. Analyst, will post later the verdict.

[harlan4096]

Quote

 

Hello,

This is not a false alarm. This site is infected.

Here is the malicious code:

<script>(function(){try {var/*_ahpqguarep*/_tguunexl= ... 4abf85e99*/})();</script>

 

If you are a webmaster, please remove the above code from the page. Also we strongly recommend that you change passwords to all services that can be used to modify website contents because they may have been stolen.

 

Sincerely
Malware Analyst
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names

 

 

[Bruno D]

Thank you!
I was able to remove the bad script by updating my wordpress theme and Kaspersky no longer blocks the site.
Meanwhile Virus total still points it as malware since Fortinet flaged it. Is this a temporary thing or there's more malware besides the one that I removed?

Thank you all for the attention

[harlan4096]

Quote

Is this a temporary thing or there's more malware besides the one that I removed?

Yes, probably... until They get aware of the false positive and update their signatures.

[Bruno D]

Thank you 🙂