Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: MikeRepairs on December 06, 2011, 09:09:27 PM

Title: Yahoo Mail attachment = malicious URL
Post by: MikeRepairs on December 06, 2011, 09:09:27 PM
Yahoo mail has a PDF attachment from a valid source. This is a legitimate attachment that was expected from a bank, not just a random email.
Clicking on Open or Download causes Avast to show the red message and block a "malicious URL".
This has to be a false positive. Yahoo certifies they scanned the message with Norton. If I disable Avast, download the file and scan with avast, it is clean. This is happening with other pdf attachments on yahoo today as well.

Can you verify and fix?

ht tp://ne1.attach.mail.ymail.com/us.f1202.mail.yahoo.com/ya/securedownload?mid=1_438981_ALZVimIAAQtaTt5oDQhy%2FVL4q44&fid=Inbox&pid=2&clean=0&redirectURL=http%3A%2F%2Fus.mg5.mail.yahoo.com%2Fneo%2Fphp%2Foutage.php%3Fb%3D_3324&cred=mX5qZbGQx7_GIGl2rjwohb0iBSS2aBLjRgCYrJ.BtEU5XPPjBGxGS421g8Y08PpuwA16FTF4JcWBX5iBcyptCNdVZstzhW1Xk0MCpxf_6qVU1Ag2W13XtA--&ts=1323200678&partner=ymail&sig=Tvjx1MCgD_nUmlhkS7IfKA--

Win7 64 bit Home Premium.
Avast Free: 6.0.1367
definition: 111206-2
Title: Re: Yahoo Mail attachment = malicious URL
Post by: Pondus on December 06, 2011, 09:18:46 PM
and you have of course tested any attachment at VirusTotal  ?
Title: Re: Yahoo Mail attachment = malicious URL
Post by: MikeRepairs on December 06, 2011, 09:52:57 PM
No, I am not going to offer to upload my customer's bank documents to any web site
Title: Re: Yahoo Mail attachment = malicious URL
Post by: ady4um on December 06, 2011, 10:20:33 PM
The following seems very similar, so maybe the same issue that was corrected came back?

http://forum.avast.com/index.php?topic=88956.0 (http://forum.avast.com/index.php?topic=88956.0)
http://forum.avast.com/index.php?topic=88666.0 (http://forum.avast.com/index.php?topic=88666.0)
Title: Re: Yahoo Mail attachment = malicious URL
Post by: theschles on December 07, 2011, 06:45:10 AM
I am seeing the same issue.  I just posted to Twitter and to the contact form.  Hopefully this will be corrected soon...