Why is my website getting a warning message from Internet Security?

[maximgankov]

Hello! I have a website - http://astea.ru/ . And McAfee Internet Security getting Warning message about viruses and maleware, but it is not.

Please, not to scare away my customers, and check my website honestly.

From Russia with Love, where bears walking on the street and drinking "Vodka"

Message was edited by: maximgankov on 11/28/12 6:50:43 PM CST

[Hayton · Accepted solution]

http://labs.sucuri.net/?blacklist=astea.ru

Details for the domain astea.ru
   Site not known for distributing malware or acting as a redirector.
   Site found to be used on spam campaigns (either forum, comment or SEO spam).
   Our latest scan identified some issues on this site. You can do a real time scan here for more details: http://sitecheck.sucuri.net.

SiteAdvisor and TrustedSource do not block your site. SiteAdvisor has not yet tested the site.

There is however a problem with something on your site.

1)  Firefox, without SiteAdvisor

2) Internet Explorer, with SiteAdvisor

The problem is not with that image (bg_top.jpg). There was a clue in IE when the following request appeared -

Internet Explorer's Privacy Report shows what has been blocked

There is something in "q_frame.php?6" which causes SiteAdvisor to block that part of the download.

[maximgankov]

Hayton, thank you for detailed answer. Because "q_frame.php?6" asks important and famous service comments on vk.com, i guess, that "dangerous" content is artificial. I also guess, that my post will not be removed.

[Hayton]

The blocked content may be associated with these lines in the page source code -

<!-- Для работы счётчика 'мне нравиться' -->
 <script type="text/javascript" src="http://userapi.com/js/api/openapi.js?34"></script>
 <script type="text/javascript">VK.init({apiId: 2651757, onlyWidgets: true});</script>
 
  <!-- Для работы комментариев "Вконтакте" -->
 <script type="text/javascript" src="http://userapi.com/js/api/openapi.js?52"></script>
 <script type="text/javascript">VK.init({apiId: 3128951, onlyWidgets: true});</script>

In Internet Explorer only the "+1" button is displayed.

In Firefox the NoScript add-on blocked two items. Both of these were iFrames, which are sometimes used by malware authors. iFrames are sometimes blocked by antivirus programs as a precaution, and sometimes perhaps the blocking is unnecessary.