Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: producer on June 19, 2021, 09:43:40 PM

Title: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: producer on June 19, 2021, 09:43:40 PM
Hi,
Since few hours ago I am experiencing a terrible issue which blocks Amazon website. Connection aborted by Avast Free Antivirus.

URL:Mal
d3ag4hukkh62yn.cloudfront.net


This happens on Chrome, also on Firefox, only for amazon.
The Avast scan found nothing. No any foreign process in Task Manager, also nothing in the Programs and Features.
Please, anyone help me how to solve this issue!
I can't find a way to exclude this in Avast settings. And should I try to exclude it at all and how?
Big thanks in advance!
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: DavidR on June 19, 2021, 10:07:39 PM
|My default browser is Firefox - I also have some settings and extensions that could prevent 3rd party sites loading - so I don't know if this could be part of your problem. uBlock Origin, uMatrix, Privacy Badger and DucjDuckGo Privacy Essentials.

I have no problem connecting to amazon.co.uk (my normal connection for the uk) and no issues.

Just connected to amazon.com and still no issue.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: producer on June 19, 2021, 10:12:23 PM
It's weird that Amazon is being blocked for some minutes, then it loads, then blocked again, etc.
I don't use extensions, I checked again.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: DavidR on June 19, 2021, 11:04:33 PM
Sorry I don't see it, working without issues for me and if your image is correct it isn't alerting on Amazon.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: AvastParadox on June 19, 2021, 11:17:30 PM
I am also experiencing this issue. I am using the DEV version of MS Edge Version 93.0.916.1 (Official build) dev (64-bit). It started this morning. I am running the latest version of Avast, version 21.5.2470 (build 21.5.6354.675) with the latest virus definitions. I did a scan (passed) and have no new extensions added in the last few weeks. I get the same Avast warning message when I try & use Firefox (latest version) as well. Amazon website does not load. If I refresh the browser a few times, Amazon may load, but when trying to navigate the website, I may not get subsequent amazon webpages to load. If I pause the Avast Shield Controls, I can use Amzon's website normally. The error message I get when Avast Shields are up and I try and access Amazon.com is PR_CONNECT_RESET_ERROR.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: carryots1 on June 19, 2021, 11:38:39 PM
I started having this issue today (I'm on Windows 7) as well after updating to the latest version of Avast AV so it's not just you. I do have an ad blocker add in installed in Firefox (uBlock Origin) and thought that might be the issue and tried disabling it and clearing cache/cookies/DNS but no good. I then tried amazon.com in Chrome and IE (where I don't have any add ons at all) and have the same problem which means it's not a browser issue but something computer wide.

I then temporarily disabled Avast and tried the site again...and it worked right away across all 3 browsers. I rebooted (which re-enabled Avast) and the issue came right back. So unless there is something legitimately malicious on the Amazon site, it's definitely an Avast issue in some form (the way it's handling the Amazon.com site or elements within too aggressively).

To test, try disabling your Avast temporarily (or each shield individually temporarily) and see if you still have the issue.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 20, 2021, 02:58:00 AM
it may be a cloudfront url twigging, but having amazon connections immediately terminated is a simple cause/effect. theres something hinky with the webshield.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 20, 2021, 06:38:56 AM
I started having this issue today (I'm on Windows 7) as well after updating to the latest version of Avast AV so it's not just you. I do have an ad blocker add in installed in Firefox (uBlock Origin) and thought that might be the issue and tried disabling it and clearing cache/cookies/DNS but no good. I then tried amazon.com in Chrome and IE (where I don't have any add ons at all) and have the same problem which means it's not a browser issue but something computer wide.

I then temporarily disabled Avast and tried the site again...and it worked right away across all 3 browsers. I rebooted (which re-enabled Avast) and the issue came right back. So unless there is something legitimately malicious on the Amazon site, it's definitely an Avast issue in some form (the way it's handling the Amazon.com site or elements within too aggressively).

To test, try disabling your Avast temporarily (or each shield individually temporarily) and see if you still have the issue.

I sincerely doubt its something on our computers, aside from avast having a problem somewhere in its own systems...too many of us reporting, and as no two computer users have the same browsing habits or sites they frequent, the odds of us all picking up the exact same infection are...well..the odds are better on the cash 4 life or powerball lotteries here in the states.

as it is, I went into paranoid mode myself the second I thought there might be a chance it was legitimate(first instance last night) and scanned the **** out of my system with malware bytes, then, as dubious as its been acting, avast. clean scan results.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: producer on June 20, 2021, 08:51:12 AM
Well, I had no other choice but to disable the Web Shield and now I can reach Amazon website.
The Avast team should announce this issue and fix it.
I still think it's not caused by Amazon, it's kind of virus/hijack malicious which Avast blocks. But Avast MUST get rid of it instead of making us unable to visit Amazon.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 20, 2021, 04:42:57 PM
I dont think its a legitimate malware threat, I think something got into the definitions the web shield uses.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: DavidR on June 20, 2021, 05:19:00 PM
I dont think its a legitimate malware threat, I think something got into the definitions the web shield uses.

If that were the case, then surely everyone would be affected, which isn't the case.  Which makes it all the more difficult to understand.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 20, 2021, 08:18:37 PM
I'm going to test if the windows 10 app is affected by this..if not then its a safe alternative while this mickey mouse problem's going around.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 20, 2021, 08:32:02 PM
ok, got some workarounds for the folks who dont feel safe messing with the exceptions list.

the mobile apps are unaffected, and can be used for most tasks on amazon.

if you have windows 10, there IS an amazon app available that has all the same features of the website and so far has NOT tripped avast's web shield.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 20, 2021, 10:37:37 PM
I bounced this off the guys over at tenforums and one user ran a check here https://www.virustotal.com/gui/url/557ee3ca5f765ef99c3900580dac57fad08755e2283b6191bc109b06839753c2/detection and virus total says all clear...problem's definitely on avast's end.
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: pwdances on June 21, 2021, 01:19:53 AM
I have been experiencing this same problem for a couple of days. Seems to affect different browsers including: Chrome, Firefox and Opera. Is this an Avast problem? Will they fix it soon? It is frustrating to not be able to access Amazon although I have some work arounds. Anyone know if Avast will correct this problem? Thanks!
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 21, 2021, 02:46:01 AM
contact avast and report the false positive..I has no idea where the contact form wandered off to, if someone could post?
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: xraiderv18 on June 21, 2021, 02:50:56 AM
I have been experiencing this same problem for a couple of days. Seems to affect different browsers including: Chrome, Firefox and Opera. Is this an Avast problem? Will they fix it soon? It is frustrating to not be able to access Amazon although I have some work arounds. Anyone know if Avast will correct this problem? Thanks!

found the form https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: Muad'Dib on June 21, 2021, 06:15:53 AM
I'm also getting the same cloudfront URL (hXXps://d3ag4hukkh62yn.cloudfront.net) warning when accessing a link on Amazon.com. It's inconsistent (sometimes I can get through, sometimes Amazon is blocked by Avast), but it happens most frequently when I'm on the page hXXps://wXw.amazon.com/gp/css/homepage.html and then hover the cursor over the "Hello (Username)" near the upper right corner of the page (to the left of the "Returns & Orders" link and to the right of the language flag icon). For me, this just started this evening (June 20th) US time. I had accessed the same page and links without a warning today late in the afternoon. I've already submitted a suspected false positive report and hopefully others will do so too.

FYI, you can get the warning every time by entering the above-mentioned cloudfront URL directly. Also, if you type in the URL into a Google search window, there are several hits for this identical URL going back at least a couple of years (one from a MalwareBytes forum from Feb 9, 2020). Also if you enter the cloudfront URL into VirusTotal.com, it reports it as being clean (previous to my uploading, the same URL was posted yesterday on VirusTotal). Interestingly (to me at least), Avast is not listed among the various engines evaluating the URL.

As others have noted, this does not seem to be browser-specific (I get Avast warnings for this URL from every browser I've tried).

Update: Entering the cloudfront URL from Tor does NOT generate an Avast warning - instead it takes me to what looks like the Amazon.com homepage (though the URL in the address bar still says cloudfront). To quote Alice: "Curiouser and curiouser"
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: Muad'Dib on June 21, 2021, 01:52:17 PM
Email response from Avast this morning:

Quote
Hello,

Thank you for reporting this false positive.

Our virus specialists have now cleared its reputation in our database.

With URLs this change should be instant, but it might take up to 24 hours with files.

For future reference you might also find the following article to be useful:  <Link: https://support.avast.com/en-us/article/228/> Avast Clean Guidelines.


Best regards,

Avast Customer Care

However, Avast is still flagging Amazon, even though I tried to update the definitions (it said it was already up to date: v210621-2). I guess I'll just whitelist that specific cloudfront.net URL for awhile and then test it later today or tomorrow with the whitelist removed.

Also, while VirusTotal.com showed no flags when I entered the cloudfront URL late last night, a few hours later the same website showed that Comodo Valkyrie Verdict was flagging the URL as malware (maybe their employees read this forum? ???).
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: codewalkerDan on June 21, 2021, 03:59:12 PM
I'm also getting the same cloudfront URL (hxxps://d3ag4hukkh62yn.cloudfront.net) warning when accessing a link on Amazon.com. It's inconsistent (sometimes I can get through, sometimes Amazon is blocked by Avast), but it happens most frequently when I'm on the page https://wxx.amazon.com/gp/css/homepage.html and then hover the cursor over the "Hello (Username)" near the upper right corner of the page (to the left of the "Returns & Orders" link and to the right of the language flag icon). For me, this just started this evening (June 20th) US time. I had accessed the same page and links without a warning today late in the afternoon. I've already submitted a suspected false positive report and hopefully others will do so too.

I used that cloudfront url in here (https://www.virustotal.com/gui/url/207dc5c947c3966ea3f58c7c929a2bd0f14db46220cbc6e4dfe4cf15b04c3f54/detection) and Apparently there is a malware reported on one site
Title: Re: HELP: URL:Mal d3ag4hukkh62yn.cloudfront.net
Post by: DavidR on June 21, 2021, 04:24:20 PM
@  codewalkerDan
Please change the quoted text in your post to prevent accidental exposure.
Change the URL from http to hXXps and www to wXw (as I have done in the quoted post), to break the link and avoid accidental exposure to suspect sites, thanks.

I'm also getting the same cloudfront URL (hXXps://d3ag4hukkh62yn.cloudfront.net) warning when accessing a link on Amazon.com. It's inconsistent (sometimes I can get through, sometimes Amazon is blocked by Avast), but it happens most frequently when I'm on the page hXXps://wXw.amazon.com/gp/css/homepage.html and then hover the cursor over the "Hello (Username)" near the upper right corner of the page (to the left of the "Returns & Orders" link and to the right of the language flag icon). For me, this just started this evening (June 20th) US time. I had accessed the same page and links without a warning today late in the afternoon. I've already submitted a suspected false positive report and hopefully others will do so too.

@  Muad'Dib
Likewise to you, please change your post as indicated above to prevent accidental exposure, not to mention effectively promoting that site because of search engine web crawlers collecting urls.