Avast WEBforum

Other => Viruses and worms => Topic started by: loungehake on January 22, 2023, 03:09:46 PM

Title: False Positive? Avast has blocked Netcraft browser extension
Post by: loungehake on January 22, 2023, 03:09:46 PM
I use the Netcraft browser extension. Avast has suddenly declared it a phishing hazard. I thought that Netcraft was an internet security business of high repute.

I have found and submitted a report on the Avast false positive form.
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: constipatedapples on January 22, 2023, 08:56:56 PM
Its really getting on my tits now , they better sort it soon.
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: DavidR on January 22, 2023, 09:24:29 PM
What would be of help is a screenshot of the avast alert window with the details option displayed.
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: constipatedapples on January 22, 2023, 11:05:56 PM
This is the screenshot
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: DavidR on January 22, 2023, 11:50:02 PM
Were you actually trying to connect to that URL  ?

It may well not be the case, it may well have been the browser extension trying to connect to that URL and not the user directly. 

You should also note that the original connection URL does a redirect to a different URL, everything after the netcraft.com/.   I can only assume (dangerous I know) that is what Avast doesn't like the redirect to /check_url/v3/hxxps/://wiki.firestormviewer.org/dodns (note the hxxps is to prevent the link being active).
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: loungehake on January 23, 2023, 07:55:03 AM
This is yer actual screenshot.

The browser extension was attempting to connect to URL mirror2.extension.netcraft.com.  I had no problem earlier yesterday,  This is the first time I have seen a browser extension problem being flagged by Avast.  It has disrupted several people for whom I had installed the Netcraft browser extension some years ago.  I am having to talk them through disabling that extension.  I was most surprised that Netcraft has been identified as a phishing hazard. Oh lackaday!

I hope that Avast corrects the matter very soon.
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: loungehake on January 23, 2023, 08:06:44 PM
Avast has rectified the problem. It happened sometime on the middle of today (Monday 23 January).
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: DavidR on January 24, 2023, 01:00:55 PM
Thanks for the feedback, unfortunately for whatever reason the forums have been down for a day and a bit.

I would like to hope it was maintenance to correct the forums performance issues.
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: loungehake on January 24, 2023, 07:50:59 PM
Whatever I say about Avast from time to time, there is no better security software than Avast's/AVG's.  I have great confidence in them.
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: polonus on January 28, 2023, 02:02:31 PM
You could and should trust avast.

Remember also that cybercriminals now also are manipulating search-engine results,
so one will land at a fraudulous site or users, that download an extension outside checked reliable sources.

I mentioned also certification abuse recently, where pre-cert chains are being abused by malcreants.

So when visiting a bank etc. Do not go there directly from a search-engine result link, it could be a fraud scheme. So check before you leap. Forewarned is forearmed.

polonus
Title: Re: False Positive? Avast has blocked Netcraft browser extension
Post by: DavidR on January 28, 2023, 05:52:24 PM
Whatever I say about Avast from time to time, there is no better security software than Avast's/AVG's.  I have great confidence in them.

Agreed, it has been looking after my systems for 19 years (before I even first visited the forums), I have had the odd niggle.  But nothing serious and nothing security related, lucky I guess (not) :)