AntiVir Detecting HTML/Infected.WebPage.Gen Virus on WordPress

by Riyad Kalla on 18. Jun, 2009 in Technology

Guys, if you are seeing something like this when you visit this site:

antivir-wordpress-infected.webpage.gen-virus-bad-detection

It’s OK — It looks like AntiVir (among other antivirus companies) have decided to detect remote iFrame references in webpages as a “virus” — unfortunately WordPress (like this site) and many of the WordPress plugins make use of iFrames to work.

A lot of people are noticing this on all sorts of WordPress sites (More #1, More #2). We seem to have picked up this behavior right after updating to WordPress 2.8 so that might be what is going on here.

We are looking into this…

Tags: , , , ,

This post was written by:

Riyad Kalla - who has written 2270 posts on The Buzz Media.

Software development, video games, writing, reading and anything shiny. I ultimately just want to provide a resource that helps people and if I can't do that, then at least make them laugh.

Contact the author

No Responses to “AntiVir Detecting HTML/Infected.WebPage.Gen Virus on WordPress”

  1. Kipper 29. Jun, 2009 at 3:19 am #

    Firefox is suddenly telling me this is a “reported attack site”… though I’ve never had any issues in the past …

    Avast pops up with a warning about blocking traffic from a malicious address or somethin as well …

    Reply
    • Riyad Kalla 30. Jun, 2009 at 8:50 am #

      Kipper,

      Should be fixed now, had some plugin shenanigans going on. Manually cleaned everything out.

      Reply
  2. Kaiz 26. Jan, 2010 at 8:15 am #

    Hi. Any fix for this? I can no longer go to my dashboard because of this warning.

    Reply
    • Riyad Kalla 26. Jan, 2010 at 12:54 pm #

      Kaiz,

      In my case the warning was legit — the problem turned out to be hacked .php files on the server side that had external

      Reply
  3. Nick 09. Feb, 2010 at 7:17 pm #

    LOL, wordpress is nothing. Avira also detects it on
    http://www.eia.doe.gov/ (US Energy Information Administration) :)

    Reply
    • Riyad Kalla 09. Feb, 2010 at 10:25 pm #

      Oh man, did you check the source of the page and see if there was infact an injection attack? It’s typically an in the last part of the page before tag.

      Reply

Leave a Reply