Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: perplexed on October 08, 2006, 05:11:46 AM
-
Hi -- I got avast virus alerts when visiting several microsoft web pages. The pages are:
http: //www.microsoft.com/windowsxp/using/setup/tips/advanced/ntfs.mspx
and
http: //www.microsoft.com/windowsxp/using/setup/maintain/backupfiles.mspx
(I have added spaces, so that the links are not clickable)
I get a msg something like this:
Virus detected. Malware stopped before it could enter your computer. Click "abort connection" and the download of the dangerous file will be cancelled.
File name: http://rad.microsoft.com/ADSAdClient31.dll?GetAd=PPG=consDLQ [I think]
Malware name: VBS: Zulu
Malware type: virus/worm
VPS version: 06 40-4, 10/06/2006
I am using Firefox 1.5.0.3 with the NoScript extension.
What's weird -- beside the fact that I am getting this warning on MS pages, which ought to be clean -- is that I visited these same pages about a week ago, and did NOT receive any alert. Then I bookmarked these pages, or actually, added them to the Mozilla link bar (or whatever it's called). When I revisited them, I got the alerts. (But sometimes, I can go to the page without triggering an alert -- but usually I do get it.)
I am wondering if this is some kind of a false alarm. I thought maybe it had something to do with some advertisement on the pages -- but there are no visible ads on the pages.
Can anybody explain this/ reassure me?
Is my computer really still at risk of drive-by downloads, even using FF and NoScript?
-
As Virus signatures are added or updated it is entirely possible that what wasn't previously detected might now be detected. The fact that this is on the MS site would tend to indicate an FP, but not definate.
I would also suggest you update firefox it is at version 1.5.0.7 now and not too far away version 2.0.
Ensure you have the latest VPS update one released this morning. I have visited the backupfiles.mspx and ntfs.mspx pages firefox and noscript enabled and no alerts.
I used Maxthon and it was a different ball game alerts on both pages, so it would appear that your NoScript extension either isn't working or set to accept microsoft.com and webtrends.com.
-
Thanks -- I think you may have located the source of the problem -- I don't have microsoft or webtrends as allowed sites in NoScript.
But I don't really understand why this would cause the alert. Usually, if a site is not an allowed NoScript site, the page just doesn't display or work right. I have never gotten an AV alert because of this before.
I will update Firefox, as you suggest (well, I'll get to it soon!). AVAST has up-to-date VPS files -- it auto-updates all the time.
-
Just found that others have been reporting similar experiences with MS pages. Links to the other discussions are below:
http://forum.avast.com/index.php?topic=24061.0
http://forum.avast.com/index.php?topic=23939.0
http://www.dslreports.com/forum/remark,17013740~mode=flat#17015199
-
But I don't really understand why this would cause the alert. Usually, if a site is not an allowed NoScript site, the page just doesn't display or work right. I have never gotten an AV alert because of this before.
If neither of these were allowed the script to fetch the ads wouldn't run so avast wouldn't detect anything false or otherwise. The script causing the problem is the webtrends one, disable that and no alert and no advert as shown in my images.
-
Thanks for the help, David.
I am not sure what you mean by "disable" -- I never enabled (allowed) webtrends or microsoft in the first place. "Allow webtrends" does not even appear as an option in NoScript; "allow microsoft" does, but I didn't allow it, since the page was displaying well without allowing it.
By the way, I just revisited the 2 MS pages, without any alerts. (And I reloaded each several times.) EDIT: just revisited one of the MS pages again, and DID get the alert.
Thanks!!
-
well... I've also got VBS Zulu alert while visiting a microsft site
(http://img126.imageshack.us/img126/3666/msavastalertsvbszulusc6.jpg)
-
well... I've also got VBS Zulu alert while visiting a microsft site
Here the same :(
http://forum.avast.com/index.php?topic=24353
-
I just heard right now, that a user with AVK2007 http-scan, and opera browser, also got an alert at the microsoftsite!
-
Very strange!!!!, I have downloaded IE7 yesterday, and I didn't get this alert.
Is that normal ??
-
Very strange!!!!, I have downloaded IE7 yesterday, and I didn't get this alert. Is that normal ??
http://forum.avast.com/index.php?topic=24353.msg199994#msg199994
-
From time to time Ms sites are causing false virus alarm, but as far as i know there was never found one. Usually its a bug in an updated scanner version.
-
Well this topic is over two and a half years old and I doubt this particular issue is the same as there have been major changed in the protection and detection given by avast.
So if you have some specific examples that you have experienced please post them in a new topic of their own and we can try and help.