abolfazl 0 Posted July 3, 2021 Share Posted July 3, 2021 HiOver the past few days, a large number of site users have reported to us that some of the site's pages will not open and will be blocked by NOD32 antivirus. The site is completely secure and there is no problem and they see the following: HTML/ScrInject.B trojan Blocked address (example): https://king2net.com/11746/clash-royale-hack/ How can I fix this problem? Link to comment Share on other sites More sharing options...
itman 1,594 Posted July 3, 2021 Share Posted July 3, 2021 (edited) Eset's detection is correct. Per a Quttera scan of the domain: Threat dump code shows: Additional details here: https://quttera.com/detailed_report/king2net.com Edited July 3, 2021 by itman Link to comment Share on other sites More sharing options...
abolfazl 0 Posted July 4, 2021 Author Share Posted July 4, 2021 Hello Thank you for your guidance I have now deleted the file Will the site problem be solved? Link to comment Share on other sites More sharing options...
itman 1,594 Posted July 4, 2021 Share Posted July 4, 2021 1 hour ago, abolfazl said: Hello Thank you for your guidance I have now deleted the file Will the site problem be solved? It currently scanned clean by Quttera: https://quttera.com/detailed_report/king2net.com Refer to FAQ section on the Eset forum home page on "submission of false positive" request. I would include the above Quttera scan link in the request to Eset for re-classification of your domain. Link to comment Share on other sites More sharing options...
abolfazl 0 Posted August 1, 2021 Author Share Posted August 1, 2021 On 7/5/2021 at 4:01 AM, itman said: It currently scanned clean by Quttera: https://quttera.com/detailed_report/king2net.com Refer to FAQ section on the Eset forum home page on "submission of false positive" request. I would include the above Quttera scan link in the request to Eset for re-classification of your domain. Thank you for your guidance But I still could not message eset support! Because I did not find the part you mentioned in the forum Please provide a direct link to the report Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 197 Posted August 1, 2021 Most Valued Members Share Posted August 1, 2021 58 minutes ago, abolfazl said: Thank you for your guidance But I still could not message eset support! Because I did not find the part you mentioned in the forum Please provide a direct link to the report Here you need to send an email/form as instructed here : https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab Link to comment Share on other sites More sharing options...
itman 1,594 Posted August 1, 2021 Share Posted August 1, 2021 3 hours ago, abolfazl said: Because I did not find the part you mentioned in the forum Please provide a direct link to the report I don't know how you could miss this reference. It's listed on the forum home web page. See below screen shot: Link to comment Share on other sites More sharing options...
itman 1,594 Posted August 1, 2021 Share Posted August 1, 2021 (edited) Also refer to this Sucuri analysis: https://sitecheck.sucuri.net/results/https/king2net.com/11746/clash-royale-hack/ . This site is currently blacklisted by McAfee. Interestingly, it states that Eset indicates the site is clean. However, Eset is still detecting malware on the web site and blocking access to it: My best guess here is the malicious web site script injection is only being triggered via direct browser access to the site. Eset's current detection is correct since the site still contains malware per this recent VirusTotal scan: Edited August 1, 2021 by itman Link to comment Share on other sites More sharing options...
itman 1,594 Posted August 2, 2021 Share Posted August 2, 2021 (edited) I will also add that this domain is blacklisted by Quttera: https://quttera.com/detailed_report/king2net.com which is as severe a malware classification as it gets. Edited August 2, 2021 by itman Link to comment Share on other sites More sharing options...
Habib Hosseini 0 Posted October 13, 2021 Share Posted October 13, 2021 Dear admin , There was a link to an infected site on my site and I deleted it . My site is clean now . ( attachment ) I also sent an email to the ESET After 10 days, I still can not enter my site . Please advise what to do? Site: irtci.com Link to comment Share on other sites More sharing options...
Administrators Marcos 4,838 Posted October 13, 2021 Administrators Share Posted October 13, 2021 Quote There was a link to an infected site on my site and I deleted it . My site is clean now The website was compromised. Please remove all references to joyshoul.com. Link to comment Share on other sites More sharing options...
Habib Hosseini 0 Posted October 13, 2021 Share Posted October 13, 2021 I find it in my first page and remove it , now Site is Ok How can I find out if this link is not on other pages of the site? Link to comment Share on other sites More sharing options...
Administrators Marcos 4,838 Posted October 13, 2021 Administrators Share Posted October 13, 2021 You should have access to all files on your site so you can search them all for a reference to the malicious domain. Link to comment Share on other sites More sharing options...
Habib Hosseini 0 Posted October 13, 2021 Share Posted October 13, 2021 Really Thanks . I seem to have to search all 1500 pages . I wish there was software that would find the pages where this link was added . Google can also help Site:irtci.com ( link ) Anyway, thank you for your help Link to comment Share on other sites More sharing options...
Most Valued Members Nightowl 197 Posted October 13, 2021 Most Valued Members Share Posted October 13, 2021 1 hour ago, Habib Hosseini said: Really Thanks . I seem to have to search all 1500 pages . I wish there was software that would find the pages where this link was added . Google can also help Site:irtci.com ( link ) Anyway, thank you for your help Download the source files for your website , let ESET scan it , it should pinpoint which files are having it, can make your search easier. Link to comment Share on other sites More sharing options...
Habib Hosseini 0 Posted October 13, 2021 Share Posted October 13, 2021 not work , in ASP website links add in SQL Data Base , Link to comment Share on other sites More sharing options...
Most Valued Members peteyt 373 Posted October 13, 2021 Most Valued Members Share Posted October 13, 2021 10 hours ago, Habib Hosseini said: not work , in ASP website links add in SQL Data Base , Not sure if this will help https://www.quora.com/How-can-I-find-a-piece-of-code-in-all-of-my-websites-files Link to comment Share on other sites More sharing options...
Recommended Posts