Avast WEBforum
Other => Viruses and worms => Topic started by: Elrogos on December 27, 2009, 12:56:36 PM
-
Hi,
Im getting a virus alert when login to Yahoo Mail. The malware name is HTML:Iframe-inf, and Im using Avast Personal fully updated. There is no infection on my side, as the program blocks the connection; and as far I can tell, there is neither an infected mail there (havent seen this alert, ever, and I use that account every single day) nor a new mail on the inbox which may be infected.
I hope it is a false positive, because I need to access that account. If you need more info just tell me.
-
I am also getting virus alerts when I log in to Yahoo Mail - they weren't there last night, but are there now.
EDIT - It's on Yahoo answers too. It seems to be from one of the adverts which is on the screen.
-
I am experiencing the same problem.
This is happenning when I try to access a Yahoo email account I have had for years and use practically every day.
-
Same thing here on www.yahoo.no ( HTML:Iframe-inf )
* avast! Real-time Shield Scan Report
* This file is generated automatically
*
* Started on: Saturday, December 26, 2009 3:34:59 AM
*
27.12.2009 13:23:23 hxxp://no.yahoo.com/|>{gzip} [L] HTML:Iframe-inf (0)
27.12.2009 13:23:33 hxxp://no.yahoo.com/|>{gzip} [L] HTML:Iframe-inf (0)
27.12.2009 13:24:50 hxxp://no.yahoo.com/|>{gzip} [L] HTML:Iframe-inf (0)
27.12.2009 13:25:56 hxxp://no.yahoo.com/|>{gzip} [L] HTML:Iframe-inf (0)
27.12.2009 13:27:02 hxxp://no.yahoo.com/|>{gzip} [L] HTML:Iframe-inf (0)
27.12.2009 13:28:17 hxxp://no.yahoo.com/|>{gzip} [L] HTML:Iframe-inf (0)
27.12.2009 13:37:10 hxxp://no.yahoo.com/|>{gzip} [L] HTML:Iframe-inf (0)
-
Hello all, welcome to the forum :)
I have taken a look at some of the pages, and I can't seem to find any references to malware (but that could just be my inability...)
What I would suggest to do:
When an alert appears, in the bottom right of the alert, please click on 'Report as a False Positive' as this is the best way to alert ALWIL.
I have also emailed them this info...
-Scott-
EDIT:
Same thing here on wXw.yahoo.no ( HTML:Iframe-inf )
Strange...no alert first time I visited...then an alert second time...
-
What I would suggest to do:
When an alert appears, in the bottom right of the alert, please click on 'Report as a False Positive' as this is the best way to alert ALWIL.
no such thing in Avast 5 Scott ? but if you have emailed then i guess it will be gone soone
EDIT: jepp the function is there but does`t show on every detection
Strange...no alert first time I visited...then an alert second time...
Same her, does not happen every time, when i am logged in there is a different detection ( URL:Mal )
-
I don't know about avast! 5, but I have also reported it like described above, so hopefully we will find out.
-Scott-
-
No i am having Warning in Avast forum also, click on the pic in Mike Buxton post
http://forum.avast.com/index.php?topic=52586.msg446148#msg446148
-
No i am having Warning in Avast forum also, click on the pic in Mike Buxton post
http://forum.avast.com/index.php?topic=52586.msg446148#msg446148
No alert with avast! 4.8, what is the actual alert on? Remember hXXp ;)
Wait...it is the ad banner at the top...
27.12.2009 12:48:06 Network Shield: blocked access to malicious site ad .yieldmanager .com/imp?Z=728x90,468x60&s=692800&t=2 [ C:\Users\Scott\Portableapps\FirefoxPortable\App\firefox\firefox.exe ( 4088 ) ]
-
This isnt exclusive of Yahoo, found it on gamefaqs too ( wXw.gamefaqs.com , might have some ads). I wonder if someone with the Yahoo problem could check: go to the search bar, write anything, "asd" for example, and click on the "Go" button, if you dont get it, click back and "Go" again ... voilá, Avast alert, HTML:Iframe-inf.
I didnt get it with the Mike Buxton image thought.
At least im not the only one >:(
EDIT: Got the Mike Buxton's post alert, AdBlockPlus was preventing me from seeing the offending banner.
-
Getting the error here too..
-
Started this morning when I started to us my computer, at 1am last night was not doing this. I do notice that at 6:29am this morning the virus database was updated, there was a update also on 12:26 however at 6:29 pm and I used my computer last night and it was not doing this. I am thinking the 6:29 virus database update this morning is the culprit. Anybody else with thinking?
-
Im getting it trying to access my yahoo groups, but one of them isnt infected.
I can access Yahoo search engine no problem. But it affects my yahoo mail account from being accessed too.
I noticed with Yahoo some of my mail arrives displayed incorrectly. it come sas a long list of pathways the mail has traveled, in which somewhere the message is burred!.
-
Hello,
By no means an expert here, I am also getting a virus message on my Yahoo Home page. Mine is different though. It is js:scriptip-inf[trj]. I am running my avast now and I ran it earlier and it came up with no virus. Any suggestions anyone?
Thanks,
John
-
Here is what shows in my network log
27.12.2009 08:15:41 Network Shield: blocked access to malicious site ad.yieldmanager.com/pixel?id=600633&t=2 [ C:\Program Files\Internet Explorer\iexplore.exe ( 2704 ) ]
27.12.2009 08:16:53 Network Shield: blocked access to malicious site ad.yieldmanager.com/pixel?id=600633&t=2 [ C:\Program Files\Internet Explorer\iexplore.exe ( 2792 ) ]
27.12.2009 08:17:06 Network Shield: blocked access to malicious site ad.yieldmanager.com/pixel?id=166558&t=2 [ C:\Program Files\Internet Explorer\iexplore.exe ( 2792 ) ]
27.12.2009 08:23:24 Network Shield: blocked access to malicious site ad.yieldmanager.com/pixel?id=600633&t=2 [ C:\Program Files\Internet Explorer\IEXPLORE.EXE ( 4848 ) ]
27.12.2009 08:41:03 Network Shield: blocked access to malicious site ad.yieldmanager.com/pixel?id=600633&t=2 [ C:\Program Files\Internet Explorer\IEXPLORE.EXE ( 4780 ) ]
27.12.2009 08:41:17 Network Shield: blocked access to malicious site ad.yieldmanager.com/pixel?id=500443&t=2 [ C:\Program Files\Internet Explorer\IEXPLORE.EXE ( 4780 ) ]
here is the warning log info -------- **PLEASE NOTE THE TT IN HTTP AND X IN WWW DONE SO AS NOT CLICABLE**
12/27/2009 8:40:53 AM SYSTEM 1492 Sign of "JS:ScriptIP-inf [Trj]" has been found in "hxxtp://m.wXw.yahoo.com/\{gzip}" file.
12/27/2009 8:38:55 AM SYSTEM 1492 Sign of "JS:ScriptIP-inf [Trj]" has been found in "hxxp://m.wXw.yahoo.com/\{gzip}" file.
12/27/2009 8:27:19 AM SYSTEM 1492 Sign of "JS:ScriptIP-inf [Trj]" has been found in "hxxp://m.wXw.yahoo.com/\{gzip}" file.
12/27/2009 8:23:43 AM SYSTEM 1492 Sign of "JS:ScriptIP-inf [Trj]" has been found in "hxxp://m.www.yahoo.com/\{gzip}" file.
12/27/2009 8:15:27 AM SYSTEM 1492 Sign of "JS:ScriptIP-inf [Trj]" has been found in "hxxp://m.wXw.yahoo.com/?r947=1261919727\{gzip}" file.
12/27/2009 8:15:27 AM SYSTEM 1492 Sign of "JS:ScriptIP-inf [Trj]" has been found in "hxxp://m.wXw.yahoo.com/\{gzip}" file.
-
Me too.
I am getting it when on Youtube.com
It showed as below;
http://m.wxw.yahoo.com/\{gzip}
JS:ScriptIP-inf [Trj]
It kept appearing many times, no matter I abort the connection. What should I do? Report it as false positive? I have 4.8 Avast. Thank you.
-
I agree that it is the last update. Began happening on two computers in my home immediately after update.
-
I think this is the result of a recent addition of ad.yieldmanager to the network shield block list, as it is considered malicious, and yahoo somehow scripts it into it's pages, which would cause the alert...
http://www.mywot.com/en/scorecard/ad.yieldmanager.com
This is however, my guess on the subject...
-
I'm getting the same message that Goldscooby is on yahoo....JS:ScriptIP-inf [Trj] ......what's up with this? I have Avast 4.8 and everything was fine last night...it started this morning.....Thanks!
-
I don't see an alert but then I block ad.yieldmanager.com with my HOSTS file:
http://hosts-file.net/?s=ad.yieldmanager.com&x=24&y=10
-
Same problem with me, 2 times this morning that I wanted to read my mail avast blocks a worm and some adds in the yahoo page don't show at all....
-
I don't see an alert but then I block ad.yieldmanager.com with my HOSTS file:
http://hosts-file.net/?s=ad.yieldmanager.com&x=24&y=10
That would be why you didn't see it in the other thread... ::)
-
I am getting the same errors when I open my homepage, which is yahoo. I am running malwarebytes right now but it is not finding anything (good thing). Have any decisions been made? Is this just a false positive caused by a recent database update? What precautions are being taken? Helpful hints are appreciated.
-
Hello guys,
this false positive will be corrected in new vps update in about 30 minutes. We are blocking ads from yieldmanager.com (by mistake because they were in our stats as distributor of Fake Antivirus websites).
Thank you for information you have provided.
Regards
-
Turned off network shield yet another false positive was ok yesterday before recent vps update. How annoying! running web shield only and ok! cannot be a virus!
-
I have Firefox. I use Ghostery, Karma Blocker, WOT, etc from add ons. It kept popping many times. I aborted it, but it continued popping. Now, what do I need to do, then? Thank you.
-
Hello guys,
this false positive will be corrected in new vps update in about 30 minutes. We are blocking ads from yieldmanager.com (by mistake because they were in our stats as distributor of Fake Antivirus websites).
Thank you for information you have provided.
Regards
Thank you for the update :)
-
Hey guys,
I also got the alert at Yahoo mail.
I am getting an alert from my Weather Pulse program also.
It says that a trojan was found. Malware Name: JS:ScriptIP-inf {trj}.
Should I report both as false positives?
Thanks
-
Hey Im a newb just wanted to report I am getting the same problem after the update, but also as Yahoo! is my home page, anytime I simply click to yahoo.com, it comes up and states a Trojan horse was found !
file name- http://m.www.yahoo.com/\{gzip}
Malware name- JS:ScriptIP-inf [Trj]
Malware type- Trojan Horse
VPS version- 091227-0, 12/27/2009
Kinda freaked me out at first, but I'm hoping this is related to the issue on this thread.
I downloaded the Malwarebytes' Anti-Malware program and found 0 objects out of 97851.
I use firefox but it does the same on IE.
-
Yes, it is related, will be fixed as said above.
-
Yes, it is related, will be fixed as said above.
Nothing like False positive to bring new posters to see this wonderful site.
-
Thank you for all your help! And taking care of this so quickly! :)
-
Hello guys,
this false positive will be corrected in new vps update in about 30 minutes. We are blocking ads from yieldmanager.com (by mistake because they were in our stats as distributor of Fake Antivirus websites).
Thank you for information you have provided.
Regards
Joined these forums to post about this problem we are all having...thought I would look around first. Now I don't need to complain as you folks are aware and the fix is coming...thanks.
-
Just wanted to say that I'm getting the same messages on a Dutch forum I've been frequenting for the last few months without any issues.
The messages are "JS:ScriptIP-inf [Trj]" "HTML:Script-inf" and "HTML:Iframe-inf". Can I conclude that those are also false positives?
-
I'm getting the same popup on all Flickr pages. I assume this is related. The "problem" site is ad.yieldmanager.com
-
Nothing like False positive to bring new posters to see this wonderful site.
;D........754 Guests, 47 Users
-
Oh, its the same for me.
Its on all yahoo's pages: Flickr, Answers, Mail and everything..
Is it a false positive or ..??
I'm again worried with avast.
I already had a great disaster during the previous false positive problem.
Thanks for avast for solving it soon :D
-
i have this ad.yieldmanager popup showing on yahoo msgr and chrome.exe
-
Fixed in actual vps update -> please update your avast!.
Best Regards
-
Update has just been released, mine updated itself...if you haven't, update manually.
Confirmed, it seems this update fixes the alerts :)
Hello guys,
this false positive will be corrected in new vps update in about 30 minutes. We are blocking ads from yieldmanager.com (by mistake because they were in our stats as distributor of Fake Antivirus websites).
Thank you for information you have provided.
Regards
EDIT:And as I post it is also posted by jsejtko himself... :)
-
I'm getting more and more worried.
Why is avast getting many false positive issues these days.
This is too bad. :-\ :'(
-
Thanks for the Quick Fix Avast Team :)
-
I got that message too......
bla bal bla is infected by HTML:Iframe-inf, Deleted x16
I upgrade my VPS now
no that warning again :)
-
Hi,
im not, im chuffed to bits with this great free software. I would rather they find false positives and fix them than not find viruses and we all get infected :).
Many thanks to Avast :)
-
can someone provide a link to the file update please. As i goto Avasta UK and the update is an old one.
-
can someone provide a link to the file update please. As i goto Avasta UK and the update is an old one.
Right click avast! tray icon --> updating --> iAVS Update
-
Hi folks,
We were there before, because the ads.yieldmanager.com was IP blocked, it had this netshield FP.
This time around the FP was not there very long, and apparently now corrected, Foxyrobbin just update manually,
091227-1 most recent av update...
polonus
-
Fixed for me too, many tanks jsejtko and all the team ;-)
-
the file doesnt download from the site by following hte instructions given.
0 out of 371,514 bytes complete ???
-
http://www.avast.com/eng/updates.html
the update instructions given, dont work, the software fails to start download
-
Good morning and Happy Holidays, everyone.
I joined the forum today because I started experiencing the same issue for first time today; Yahoo.com is set as my homepage for both Firefox and IE (though Firefox is my default browser). I use Yahoo Mail daily, but, this is a moot point it seems, since I'm starting at Yahoo.com, anyway.
I, too was alerted to JS:ScriptIP-inf [Trj] by avast!, and was way concerned...
So, is everybody in agreement that we can just ignore this?
Hope
-
manual update, downloaed, went to install, and installation said i have latest update. Im still having problems viewing yahoo groups
http://www.avast.com/eng/updates.html
The latest iAVS update was published on: 27.12.2009 version: 091227-1
The update i see is 31mb file
-
Problem solved.
Excellent.
I am so glad I chose Avast for my new pc.
-
I was experiencing problems on Yahoo earlier today due to the adyieldmanager issues. I updated avast as instructed, went back into Yahoo and adyieldmanager is now apparently accepted. However, HTML:Iframe-inf is now identified as a virus and, consequently, Yahoo mail still can't be accessed. Any ideas when this will be fixed, please?
-
I also have the message However on my Windows XP it is fie. Yet when I ry t go into email via firefow o IE I am still getting the message. I have scannd and it puts it into chest (38 files) But when I try to go back into yahoo email it still appears.
I am not pc literate and am now at my wits and as I need access on my pc for my work. (my vista)
-
:) 'Joined this forum this morning just to see if the trojan warnings on hxxp://weather.yahoo.com/forecast/USIN0305_f.html were FPs. An update occurred on its own and the FP had disappeared, but I wanted to know what had happened.
Thanks to all for the answers and to ALWIL for the fast fix. Great product!
-
Hi all,
I'm also a first-timer here, having this same problem though my computer claims to have downloaded the latest update 091227-1. Is anybody else still struggling? Does it matter?
Thanks to all, I really appreciate the helpful comments in this thread.
Dave
-
Is anybody else still struggling? Does it matter?
Yes and yes.
I, like many others, use Yahoo as my main e-mail account and also use Yahoo groups. While this may not affect you, it is a major problem to many of us and the problem needs to be resolved.
-
Put me on the fixed wagon, did the update manually, now all is happy in my world.
Thanks Avast for not only fixing this as quickly as you did, but for being on top of things as you were and allowing us to have this great AV program.
To the kitchen, my pea soup recipe awaits.....
-
Is anybody else still struggling? Does it matter?
Yes and yes.
I, like many others, use Yahoo as my main e-mail account and also use Yahoo groups. While this may not affect you, it is a major problem to many of us and the problem needs to be resolved.
Hi Ulfar,
You misunderstand me. By 'Does it Matter?', I mean 'Should I ignore it?' not to poke fun at those who think it does. I shall be more circumspect with my words. I still want to know how to fix it, manual update having failed.
-
I have downloaded update as well and fix did not work? What next? Suggestions?
-
try getting updates again if it doesn't work reinstall
-
I have downloaded update as well and fix did not work? What next? Suggestions?
Confirm what VPS version you have, right click the avast 'a' icon, select about avast ?
-
4.8 Home
-
***
Tom -
You supplied the version of avast and not the VPS. Look for "File Version."
***
-
Charley -
Thanks for being helpful. My File Version is 091127-1. But I just removed the progam then went to the website and downloaded again. I no longer have this problem.
-
Thank you for fixing this so promptly. I spend a lot of time on the Flickr site, and found the popup warnings quite disquieting.
-
Another worried newbie in UK - same problem with Yahoo. I have also manually updated and it hasn't fixed the problem. Do I have to uninstall avast and reinstall? (I'm afraid I'm not very computer literate so please tell me what to do in words of few syllables! :)
-
First confirm what VPS version you have as I mentioned in Reply #62:
Confirm what VPS version you have, right click the avast 'a' icon, select about avast ?
If you have the latest one then a reinstall is unlikely to change that fact, but first try a repair of avast. Add Remove programs, select 'avast! Anti-Virus,' click the Change/Remove button and scroll down to Repair, click next and follow. This has in the past resolved this out of sync issue between reported and actual VPS version.
-
Thank you, David. I have 091127-0. This would seem not to be the latest one, as Tom71 has 091127-1. Shall I try to repair as you suggest?
-
4.8 Home
-
BTW, in control panel I only have one button to 'uninstall/change' - will that give me the repair option if I click it?
-
I tried the manual update and it just sits at zero and doesnt download
when i go to avast.com and down load the update, avast refuses to except the update saying i have the current update.
My version is
091127-0
-
Same here, Foxyrobin.
-
Thank you, David. I have 091127-0. This would seem not to be the latest one, as Tom71 has 091127-1. Shall I try to repair as you suggest?
First try the manual update, right click the avast 'a' icon, select Updating, iAVS Update.
BTW, in control panel I only have one button to 'uninstall/change' - will that give me the repair option if I click it?
Follow what I said, click that button as it will then display the other options available scroll down to the Repair function.
-
I tried the manual update and it just sits at zero and doesnt download
when i go to avast.com and down load the update, avast refuses to except the update saying i have the current update.
My version is
091127-0
Try the repair as suggested.
-
Have successfully carried out the repair. Will now go and have another try with Yahoo.
-
Whoopee. That seems to have fixed it. Thank you sooooo much!
-
ahh upate worked, finally lol, thanks :)
-
David - thanks for the info. I've been having problems all day with avast and yahoo. I followed the repair info you gave and all is well!
Karen
-
Many thanks to all, especially David! I have just figured out how to do the repair and this has worked. I love Avast - had problems with Norton in the distant past, so I'm very thankful for this free software that has kept my computer free of viruses for nearly a year. Many many thanks!!! Dione ;D
-
Whoopee. That seems to have fixed it. Thank you sooooo much!
You're welcome.
-
David - thanks for the info. I've been having problems all day with avast and yahoo. I followed the repair info you gave and all is well!
Karen
No problem, glad I could help.
Welcome to the forums.
-
Many thanks to all, especially David! I have just figured out how to do the repair and this has worked. I love Avast - had problems with Norton in the distant past, so I'm very thankful for this free software that has kept my computer free of viruses for nearly a year. Many many thanks!!! Dione ;D
No problem, glad I could help.
Fortunately I was wise to Norton from an early stage in computing and have never installed it, I just see enough of the problems in removing it in these forums ;D
Welcome to the forums.
-
I am also getting virus alerts when I log in to Yahoo Mail - they weren't there last night, but are there now.
EDIT - It's on Yahoo answers too. It seems to be from one of the adverts which is on the screen.
I'm new to this, so am probably doing this wrong.
I've had 2 virus alerts since last night and I can't move them to the chest, I get an error message, same when I try to move/rename or delete, I get this message with a red ribbon across the top, its long and narrow. I've been trying all day to figure out what to do. I'm afraid to hit "No action" or report as false positive, because I don't know if it is either. says: IRC:Malware-gen Virus/Worm, can't find it on the list
Its literally driving me nuts. I wasn't able to access the page where you get help. It kept saying my ID or passwords were wrong but they are not. I'm in a fix
Helpppppppppp Marg
-
It think this is unrelated to this particular problem (as this seems to be on your system rather than a yahoo related issue), so it would be best to create your own new topic:
- Please start a New Topic of your own as this seems unrelated to the original subject and will just confuse the topic and we will try to help.
- Go to this link, http://forum.avast.com/index.php (http://forum.avast.com/index.php), scroll down to the Viruses and Worms forum and click it, click the New Topic button at the top of the list and post there.
When you create the new topic give the following information:
What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe
- Or check the source file using notepad C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log and copy and paste the entry.
####
If posting URLs to suspect sites, change the http to hXXp so the link isn't active (clickable) avoiding accidental exposure.
Why it couldn't you move them to the chest, e.g. what error was displayed ?
-
mine is about the yieldmanager.com....
-
Then update the VPS version as this has been corrected as reported earlier in this topic.
Right click the avast 'a' icon, select Updating, iAVS Update.
-
Thank you DavidR - that did the job!
-
Thanks DavidR. After following your advice about using the repair option, the problem is now solved. ;D
-
You're both welcome, the Repair function is a very handy little tool.
-
It might be a malicious advertisement on the page maybe ???
-
It happened to me two days ago, I removed yahoo.com from the bookmark. There were also one or two links that I bookmarked, came up with a virus, so I deleted them. I then restarted the computer. Now, it is fine. It looks like yahoo.com is fine now. Hopefully, it will be fine from now and on.