WCL-HKA Posted December 3, 2020 ID:1424941 Share Posted December 3, 2020 Possible False Positives (detected as Malicious Website) for the following websites: https://webmail.myactv.net/ https://sso.myactv.net/ https://myservices.myactv.net https://portal.myactv.net https://idp.myactv.net Link to post Share on other sites More sharing options...
Staff TeMerc Posted December 3, 2020 Staff ID:1424977 Share Posted December 3, 2020 3 hours ago, WCL-HKA said: Possible False Positives (detected as Malicious Website) for the following websites: https://webmail.myactv.net/ https://sso.myactv.net/ https://myservices.myactv.net https://portal.myactv.net https://idp.myactv.net Hi- We'll review the sites and return once that review has been completed, thanks for your patience Link to post Share on other sites More sharing options...
Staff Dashke Posted December 3, 2020 Staff ID:1424984 Share Posted December 3, 2020 (edited) 4 hours ago, WCL-HKA said: Possible False Positives (detected as Malicious Website) for the following websites: https://webmail.myactv.net/ https://sso.myactv.net/ https://myservices.myactv.net https://portal.myactv.net https://idp.myactv.net Can you please check your website, as there seems to be a malicious script? <!-- var s="=b!isfg>#nbjmup;bcvtfAnzbduw/ofu#?bcvtfAnzbduw/ofu=0b?"; m=""; for (i=0; i<s.length; i++) m+=String.fromCharCode(s.charCodeAt(i)-1); document.write(m); //--> Edited December 4, 2020 by Dashke Link to post Share on other sites More sharing options...
WCL-HKA Posted December 4, 2020 Author ID:1425082 Share Posted December 4, 2020 TeMerc and Dashke, Thank you for your quick responses. The websites in question belong to a local ISP and are used for Webmail. I will call the local ISP and inform them of your feedback. Dashke, I will forward the malicious script code you posted to the local ISP. Thanks again for your responses and have a great weekend! Link to post Share on other sites More sharing options...
bemoats Posted December 4, 2020 ID:1425110 Share Posted December 4, 2020 Hello Dashke, Looking through the the source code we do not see this variable in the JavaScript. Can you please provide where you have found this code? Thank You! Link to post Share on other sites More sharing options...
Staff Dashke Posted December 6, 2020 Staff ID:1425423 Share Posted December 6, 2020 On 12/4/2020 at 5:26 PM, bemoats said: Hello Dashke, Looking through the the source code we do not see this variable in the JavaScript. Can you please provide where you have found this code? Thank You! Please check this link - http://myactv.net/tech-support/faq.php Link to post Share on other sites More sharing options...
bemoats Posted December 7, 2020 ID:1425599 Share Posted December 7, 2020 Hello Dashke, I have had this script removed from the page. Thank you for your assistance. Link to post Share on other sites More sharing options...
WCL-HKA Posted December 8, 2020 Author ID:1425980 Share Posted December 8, 2020 Hi Dashke, Are there additional remediation steps required? Do the domains listed above need to be whitelisted? The websites above are still being detected by Malwarebytes as being malicious. From the previous post, the website developer has removed the script in question. Thanks Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now