# Why did Avast protect my computer from malware from a legit website. **URL:** \ **Category:** Factual Questions\ **Created:** [June 22, 2011, 1:21pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419 "2011-06-22T13:21:38Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![I\_Know\_Nothing](https://avatars.discourse-cdn.com/v4/letter/i/f04885/32.png) [@I\_Know\_Nothing](https://boards.straightdope.com/u/I_Know_Nothing)\ **Post date:** [June 22, 2011, 1:21pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/1 "2011-06-22T13:21:38Z")
I just went to [americantangoinstitute.com](http://americantangoinstitute.com) and Avast intervened, saving my computer at the last minute from malware. It said the potential threat was from lframe.inf. Could this dance studio’s website have been hacked? Is this a common way to spread malware? ---
**Author:** ![Mops](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mops/32/16494_2.png) [@Mops](https://boards.straightdope.com/u/Mops)\ **Post date:** [June 22, 2011, 1:38pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/2 "2011-06-22T13:38:12Z")
FWIW Avira also thinks it’s infected. This kind of thing (infecting bona fide web sites using an unpatched vulnerability in the OS or server software, in order to spread malware to the site’s visitors) seems to be reasonably common. I recall encountering it on one of every few hundreds of sites I visit. ---
**Author:** ![tanstaafl](https://avatars.discourse-cdn.com/v4/letter/t/ba8739/32.png) [@tanstaafl](https://boards.straightdope.com/u/tanstaafl)\ **Post date:** [June 22, 2011, 2:04pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/3 "2011-06-22T14:04:21Z")
Simplified, an iframe is a way of embedding one website inside of another. A lot of ads are delivered that way and the owner of the actual site has no real control over what is displayed in the iframe. In this case it could be that one of the ads that it is trying to display has malware in it; the main site may have nothing to do with it. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [June 22, 2011, 8:01pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/4 "2011-06-22T20:01:29Z")
It’s probably ads, I see a lot infections from ad networks. They **really** need to do a better job of vetting the ad banners before they are allowed to be served to the world. ---
**Author:** ![jz78817](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jz78817/32/1028_2.png) [@jz78817](https://boards.straightdope.com/u/jz78817)\ **Post date:** [June 22, 2011, 8:34pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/5 "2011-06-22T20:34:14Z")
> [@control-z](#): > > It’s probably ads, I see a lot infections from ad networks. They **really** need to do a better job of vetting the ad banners before they are allowed to be served to the world. I don’t know that it’s a “vetting” problem, IIRC the problem is with ad servers which have been compromised. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [June 22, 2011, 8:48pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/6 "2011-06-22T20:48:58Z")
> [@jz78817](#): > > I don’t know that it’s a “vetting” problem, IIRC the problem is with ad servers which have been compromised. Maybe that’s it. Well in that case they need better security on the ad servers. My theory was that that people were being allowed to upload ads to the network without them being checked first. Even if they are checked, I could see ways that the malware authors could get around detection; for example a payload could happen if the user’s doman is [aol.com](http://aol.com) but not [googleads.com](http://googleads.com). ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [June 22, 2011, 11:31pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/7 "2011-06-22T23:31:02Z")
> [@I\_Know\_Nothing](#): > > Could this dance studio’s website have been hacked? Is this a common way to spread malware? Yes, that web site has been hacked to include malware via an iframe. Yes, it’s very common. ---
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [June 23, 2011, 5:22pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/8 "2011-06-23T17:22:44Z")
> [@jz78817](#): > > I don’t know that it’s a “vetting” problem, IIRC the problem is with ad servers which have been compromised. It is not so much that they are compromised, as they fail to maintain security over the ads they allow. [A common technique used by spyware outfits](http://www.h-online.com/security/news/item/FBI-shuts-down-72M-scareware-ring-1266520.html)is to post a clean ad for a while, then swap in a dirty ad that infects computers for a short period. By the time anyone notices and reports the problem, they have switched back to the clean ad and claim innocence. The problem is allowing advertisers to control their ads in this way. Brokers need to check all ads, then not allow advertisers to make changes until the new ad has been checked. I suspect that would require a lot more manhours to oversee, so ad brokers don’t like to do that. ---
**Author:** ![JoelUpchurch](https://avatars.discourse-cdn.com/v4/letter/j/f05b48/32.png) [@JoelUpchurch](https://boards.straightdope.com/u/JoelUpchurch)\ **Post date:** [June 23, 2011, 7:06pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/9 "2011-06-23T19:06:01Z")
Last year Avast blocked some content from the [NYTimes.com](http://NYTimes.com). I thought, “This can’t be right”, but it was. Same problem with bad third party ads. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [June 23, 2011, 8:34pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/10 "2011-06-23T20:34:27Z")
Though the problems raised with third party ads are valid, that’s not the cause of the warning on the site listed in the OP. It has definitely been hacked. ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [June 23, 2011, 9:41pm UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/11 "2011-06-23T21:41:55Z")
I don’t suggest waiting for the ad companies to get their shit together, or expecting that the sites you frequent will stop using ads. You have the power to browse with an adblocker. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [June 24, 2011, 12:24am UTC](https://boards.straightdope.com/t/why-did-avast-protect-my-computer-from-malware-from-a-legit-website/586419/12 "2011-06-24T00:24:39Z")
> [@rachelellogram](#): > > I don’t suggest waiting for the ad companies to get their shit together, or expecting that the sites you frequent will stop using ads. You have the power to browse with an adblocker. Yes, to be specific, use Firefox with these two extensions: http://adblockplus.org/en/ [Flashblock](https://addons.mozilla.org/en-US/firefox/addon/flashblock/)