Advice Request HEUR:Trojan-PSW.Script.Generic

[Gandalf_The_Grey]

Thanks @Gandalf_The_Grey
I never heard about "Sucuri Security". Is it reliable ?

I don't know, maybe others more into websites do?

 

[Antus67]

There website is dedication to cleaning, protecting, secure ones website.They have 4 levels on what their cost for service is

Basic	Professional	Business	Custom

Here is their main web site: Sucuri - Complete Website Security, Protection & Monitoring

 

[JB007]

Sent to ESET with the response of Kaspersky and ESET is gonna add it to their signatures in the next update
View attachment 230031

Hello,
Just checked with ESET on a friend laptop. NOD32 detects the threat
What's up with the other antivirus ?

 

[SeriousHoax]

Hello,
Just checked with ESET on a friend laptop. NOD32 detects the threat
What's up with the other antivirus ?
View attachment 230114

I have sent the complete script to almost all AV vendors. Let's see how many of them add it to their signatures.
VirusTotal link: VirusTotal

 

[notabot]

It looks like Kaspersky and ESET detect it via a real time module, is netcraft also detecting this on the fly or it operates via blacklisting websites?

 

[JB007]

I have sent the complete script to almost all AV vendors. Let's see how many of them add it to their signatures.
VirusTotal link: VirusTotal

Thanks @SeriousHoax
I'm wondering about how VirusTotal works because Kaspersky was the first AV to detect this threat and it doesn't yet appear on the list of AV that detect this URL
Also I don't understand the difference between this two VT check : VirusTotal and VirusTotal

 

[harlan4096]

I'm wondering about how VirusTotal works because Kaspersky was the first AV to detect this threat and it doesn't yet appear on the list of AV that detect this URL

VT usually does not reflect properly Kaspersky detections, in these cases You can check if ZoneAlarm does, because it uses Kaspersky engine

 

[SeriousHoax]

Also I don't understand the difference between this two VT check : VirusTotal and VirusTotal

Like harlan4096 said, VT often doesn't reflect the actual detection and this is more common for URLs than actual sample. Also some AV may not block the site but detect the malicious script it loads.

 

[Moonhorse]

BDTL response after 4 days since submitting, netcraft still blocks as skimmer

 

[SeriousHoax]

BDTL response after 4 days since submitting, netcraft still blocks as skimmer
View attachment 230260

Reply them that the site loads a malicious script. This one: Virustotal

 

[Moonhorse]

Reply them that the site loads a malicious script. This one: Virustotal

Done , thanks

 

[JB007]

Done , thanks

Hello,
Some news from Bitdefender ?

 

[Moonhorse]

Hello,
Some news from Bitdefender ?

 

[SeriousHoax]

Update: It seems the website has been fixed. It doesn't load that malicious script anymore so safe to visit and purchase again. Cheers

 

[JB007]

Update: It seems the website has been fixed. It doesn't load that malicious script anymore so safe to visit and purchase again. Cheers

Hello @SeriousHoax
You answered my question before I ask it
I just noticed that Kaspersky no longer blocks thi site.
But Netcraft always blocks it.

 

[SeriousHoax]

Hello @SeriousHoax
You answered my question before I ask it
I just noticed that Kaspersky no longer blocks thi site.
But Netcraft always blocks it.

Kaspersky never blacklisted the site but it by default scans encrypted connections in browsers so it knows whether any known malicious script has loaded or not while Netcraft can't do that and they simply put the site in blacklist I suppose. So, that's the reason.

 

[JB007]

It's frightening to see that "great" AV are continuing to undetect this script; Panda, Malwarebytes, Sophos, McAfee, Symantec, TrendMicro !

VirusTotal

VirusTotal

www.virustotal.com