HTML/Infected.WebPage.Gen [virus]

Iconic

Avira detected this when I clicked on a new web page...

'Virus or unwanted program 'HTML/Infected.WebPage.Gen [virus]'
detected in file 'C:\Opera\Opera\cache\sesn\opr012UP.tmp.

I have cleared the cache and run a full scan and it seems the computer is clean.

As I visited the web page I would have thought my computer would be infected. Can I assume this is an unwanted program on the web page rather than a virus?

Avira's description of the virus is:
'A common attack against the web infrastructure can be the infection of harmless web pages. Some malware changes every HTML file stored on the disc and adds a link (very often an IFrame) to a site hosting malicious code. Other attacks can aim for the web servers and try to insert forwarding to the pages hosted there. The owner of these pages is advised to take them offline. Fix the hole (either on his own PC or on the server), check the pages for infections, clean them and go online again. Infected Web Pages often contain additional Iframe, Object or Script Tags. The Script Tags often contain encrypted Code.'

http://www.avira.com/en/support-threats-description/tid/3684/tlang/en

RussJK

PM me the link you followed if you still know it, I'll have a look. Also send the link to these sites to check:

VirusTotal (can also check suspicious websites)
http://www.virustotal.com/

VSCAN (can check websites as well)
http://vscan.novirusthanks.org/

URLVoid (checks reputation of domains and subdomains)
http://www.urlvoid.com/


As a side question, do you have Avira set to look for "potentially unwanted programs"? (there is an actual setting for it, not on by default, without which your are more vulnerable to rogue antiviruses).

Iconic

Many thanks for your reply. Unfortunately I cannot remember the site because I was so surprised I got the pop up telling me I had a virus. I am sure it was a regular site I visit though and if I get the pop up again I will certainly note the site.

I have Avira set to default values. Is the 'programs that violate the private domain' the one you mean?

RussJK

Under expert mode, you'll find an extended Threat Categories part here:
http://i486.photobucket.com/albums/rr227/drtweak52/40.jpg

It's been awhile since I used Avira so forgive me if my description wasn't exact. I've found two versions of the threat categories, so the main thing is to click on everything that obviously seems like something you'd want to block, e.g. "hmmm fraudulent software... will I need that?"

Iconic

My version is slightly different to yours.

The main program appears to be up to date -version 10.0.0648 dated 1/4/2011 with virus definition 7.11.07.89 dated 30/4/2011.

However the Control Center is version 10.00.12.29 dated 3/11/10! Must try and find out if this is the latest version.

spud17

Iconic wrote: »

My version is slightly different to yours.

The main program appears to be up to date -version 10.0.0648 dated 1/4/2011 with virus definition 7.11.07.89 dated 30/4/2011.

However the Control Center is version 10.00.12.29 dated 3/11/10! Must try and find out if this is the latest version.

Exactly the same as mine.
As long as the virus definitions are up to date, which they are, I'd not worry about the rest too much.
Avira will always push out major changes through the normal updates.

Just to check have a look at 'Product update' in the 'Update' section via 'Configuration' in 'Expert' mode.

asbokid

Iconic wrote: »

Many thanks for your reply. Unfortunately I cannot remember the site because I was so surprised I got the pop up telling me I had a virus. I am sure it was a regular site I visit though and if I get the pop up again I will certainly note the site.

If you use Firefox, could you use its History to narrow down the site that injected a viral infection up your backdoor?

Iconic

asbokid wrote: »

If you use Firefox, could you use its History to narrow down the site that injected a viral infection up your backdoor?

Thanks. Although I use Opera it's most probably overkill but I have it set to clear new cookies, history, disk and memory cache on exit.

aliEnRIK

Avira does stop known viruses in infected webpages
Im pretty sure your computers fine

Give it a malwarebytes scan f you want a double check

Iconic

aliEnRIK wrote: »

Avira does stop known viruses in infected webpages
Im pretty sure your computers fine

Give it a malwarebytes scan f you want a double check

Thanks aliEnRIK. I already did and it found nothing. Just pleased that everyone seems to confirm my computers clean.

I was thinking of ditching Avira and going for Microsoft Security Essentials but I think I will keep it after this!