Avast WEBforum

Other => Viruses and worms => Topic started by: nissnut on February 18, 2012, 09:09:01 PM

Title: Is this a fake Avast update or download?
Post by: nissnut on February 18, 2012, 09:09:01 PM
Hello guys, I just turned on my computer and got an error message from Avast. It said I needed to select fix now or restart the program. After selecting fix now Avast repaired itself and then I got this pop up message.
I just want to know if it is real problem or a false positive.
Here is the url  in question (in case the pic does not load) http://download117.avast.com/iavs5x/prod...
Thanks, Nissnut
Title: Re: Is this a fake Avast update or download?
Post by: Jorgenr on February 18, 2012, 09:24:16 PM
I am having the same problem. This warning keeps popping up.

JR

Title: Re: Is this a fake Avast update or download?
Post by: Pondus on February 18, 2012, 09:29:05 PM
Hmmmm......mysterious.   ::)

Anyway, entering tatt URL.....with my iPad i get  404 not found

Urlquery - suspicious
http://urlquery.net/report.php?id=22897
Title: Re: Is this a fake Avast update or download?
Post by: !Donovan on February 18, 2012, 09:38:04 PM
Anyway, entering tatt URL.....with my iPad i get  404 not found

Hence "..." there is more than just /prod


Example: -http://download714.avast.com/iavs4x/servers.def
Title: Re: Is this a fake Avast update or download?
Post by: seryi on February 18, 2012, 09:42:22 PM
Had same before, now it's ok and avast updated.
Title: Re: Is this a fake Avast update or download?
Post by: superhumanbean on February 18, 2012, 09:57:02 PM
I was having similar problems.. 1st time auto update failed, 2nd time the virus warning popped up.
It seems fine now though.
Title: Re: Is this a fake Avast update or download?
Post by: !Donovan on February 18, 2012, 09:59:03 PM
Urlquery - suspicious
http://urlquery.net/report.php?id=22897


It will always be suspicious if it can't connect. :P
Title: Re: Is this a fake Avast update or download?
Post by: SoloIo on February 18, 2012, 10:07:41 PM
Hi all
I'm experiencing the same issue here (randomly)

see, please: http://www.avast.com/en-us/lp-security-information-fp2?p_ext=0&utm_campaign=Virus_alert&utm_source=prg_fav_60_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Fit-it%2Fvirus-alert-challenger2&p_vir=al&p_prc=file://C:\Program%20Files\AVAST%20Software\Avast\setup\avast.setup&p_obj=http://download117.avast.com/iavs5x/servers.def.vpx&p_var=.%2Ffa%2Fit-it%2Fvirus-alert-default2&p_pro=0&p_vep=6&p_ves=0&p_lqa=0&p_lsu=24&p_lst=0&p_lex=292&p_lng=en&p_lid=it-it&p_elm=7&p_vbd=1367

Vista SP2 x86 Avast ! Antivirus v 6.0.1367 free - VPS 120218-1 + Online Armor premium 5.5 + MalwareBytes' Antimalware  Pro( Set not to start when Windows starts)+ Sandboxie 3.64 + Firefox 10.02

I attempted to put hXXtp://download117.avast.com into the Webprotection exclusion list with no scuccess since Avast Network shields cannot be customized

Any idea?

Thank you in advance
Title: Re: Is this a fake Avast update or download?
Post by: !Donovan on February 18, 2012, 10:12:53 PM
VirusTotal (0/19)
https://www.virustotal.com/url/55d16170c9879f6dbff8851735bac6e5d3bf61308584a3c4549eb91aae546791/analysis/1329599533/

VirusTotal (0/43)
https://www.virustotal.com/file/7ce80514a4260fe18d9db841ac2dc0fc56e5ee39b05905dcb323608ed1b9e468/analysis/1329599380/
Title: Re: Is this a fake Avast update or download?
Post by: tfe on February 18, 2012, 10:14:56 PM
I am having the same problem and error message appears only if Avast tries to download updates from server download17.avast.com. Other servers - download 116, downlod 787, etc doesn't show any problems.

Is download17.avast com infected?
Title: Re: Is this a fake Avast update or download?
Post by: !Donovan on February 18, 2012, 10:18:19 PM
avast! marked download177.avast.com as Url:Mal for some reason. We'll have to wait until they confirm that this is false positive or a real threat.
Title: Re: Is this a fake Avast update or download?
Post by: SoloIo on February 18, 2012, 10:20:59 PM
I am having the same problem and error message appears only if Avast tries to download updates from server download17.avast.com. Other servers - download 116, downlod 787, etc doesn't show any problems.

Is download17.avast com infected?

I  think it is a false positive detection, Avast detects one of its definition updates download directories
see: http://sitecheck.sucuri.net/results/http://download117.avast.com
Title: Re: Is this a fake Avast update or download?
Post by: spg SCOTT on February 18, 2012, 10:23:36 PM
From what I can tell (via a quick check of the servers.def list), download.177.avast.com is the only one being alerted on.

Definitely odd.

Report it here, if you haven't already.

http://www.avast.com/contact-form.php?loadStyles
Title: Re: Is this a fake Avast update or download?
Post by: octoberasian on February 19, 2012, 03:24:17 AM
(http://dl.dropbox.com/u/589618/ZScreen/2012-02/Screenshot-2012-02-18_17.28.41.png)

I got the same problem earlier today.  It's either a) Avast is so good it blocks itself or b) Avast had a "derp" moment. Lol.

Anyway, I hope it fixes itself.
Title: Re: Is this a fake Avast update or download?
Post by: drew316 on February 19, 2012, 03:47:52 AM
I got this today and called them since the forum was not accessible and I was concerned that Avast had been compromised in its own server or something using its own internet connection.

He did a remote look on my computer and insisted it is not Avast but some problem from faulty Windows or some remnant of some other, incompatible program like a registry key left from a long uninstalled Norton that came with the computer.  He said it would be fixed if I paid a windows service tech every couple months to service the computer.  So after 15 or a while minutes that is what he kept saying caused this, or using ccleaner, various things like that so that Avast could not function properly because of a faulty Windows or something from a 3rd party software and thus gave the message others have reported here.

I am not convinced this is the correct cause, but it is what was told to me by the Avast rep on the phone.
Title: Re: Is this a fake Avast update or download?
Post by: Somethngcreative on February 19, 2012, 04:05:09 AM
I got this today and called them since the forum was not accessible and I was concerned that Avast had been compromised in its own server or something using its own internet connection.

He did a remote look on my computer and insisted it is not Avast but some problem from faulty Windows or some remnant of some other, incompatible program like a registry key left from a long uninstalled Norton that came with the computer.  He said it would be fixed if I paid a windows service tech every couple months to service the computer.  So after 15 or a while minutes that is what he kept saying caused this, or using ccleaner, various things like that so that Avast could not function properly because of a faulty Windows or something from a 3rd party software and thus gave the message others have reported here.

I am not convinced this is the correct cause, but it is what was told to me by the Avast rep on the phone.



Hmm.. I doubt that's the case since Avast Internet Security was the only Anti-virus program that I've ever installed on my new laptop, other than Malwarebytes Pro.

I don't know much about computer but this sounds like a faulty server on their part, maybe it couldn't connect that's why it  was blocked? Nevertheless, it's weird that it's all coming from download117.
Title: Re: Is this a fake Avast update or download?
Post by: thedarkness667 on February 19, 2012, 04:11:10 AM
(http://img407.imageshack.us/img407/2650/avastwarning.jpg)

Last blocked connection: http://download117.avast.com/iavs5x/prod-ais.vpx

The link its blocking above seems to be its own update website, so it sounds like its either a bug within the program itself thatll be fixed in future, or a database/server problem. Even if their own systems holding the update data WERE infected (highly unlikely) ...remind yourself of one thing-AVAST notified you, and blocked it anyway! :) so you are safe. A temporary bug or not, it doesnt make you 100% confident about how reliable the program is in general regarding blocking suspect webpages or web data that could well be completely safe. I like avast, its detection rate is good, and I have no issues when using it with other software, so heres hoping its fixed soon. Who knows, perhaps its a minor problem and something on their own site is causing a false positive reaction
Title: Re: Is this a fake Avast update or download?
Post by: unfair.cece.it on February 19, 2012, 04:11:52 AM
just for feedback i got this message too and i know another people who got it too ..

edit: btw is just server down http://www.downforeveryoneorjustme.com/http://download117.avast.com/
Title: Re: Is this a fake Avast update or download?
Post by: thedarkness667 on February 19, 2012, 04:25:03 AM
Im hoping theyll be a notification of some sort within the next 12 hrs (if there hasnt been already) acknowledging the problem, as theres bound to be a few over worried users out there reacting to this

What I dont like about avast ... is that it tells me that it "blocked me" from visiting the suspect link, yet...
 it has a fairly large dark red warning box in the top right actually stating "Infection details"...
which will suggest to many customers that they already have the infection, when the truth is that the program is merely telling them that it has not let them visit the site, so they are completely safe. Perhaps a less harsh red box and change of wording to make things clearer might help lessen the over worry from some users  8)
Title: Re: Is this a fake Avast update or download?
Post by: EmoHobo on February 19, 2012, 04:27:10 AM
But what about me?  I never got this message and I even tried manually updating a few minutes ago just to see.  Why do some people not suffer of this?
Title: Re: Is this a fake Avast update or download?
Post by: unfair.cece.it on February 19, 2012, 04:31:23 AM
But what about me?  I never got this message and I even tried manually updating a few minutes ago just to see.  Why do some people not suffer of this?

I dont know how avast select which update server to use , but if program selects another server all works ..
Title: Re: Is this a fake Avast update or download?
Post by: EmoHobo on February 19, 2012, 04:32:25 AM
So maybe just one server was down and it turned up an error somehow due to it.
Title: Re: Is this a fake Avast update or download?
Post by: thedarkness667 on February 19, 2012, 04:41:36 AM
Im not sure if I can mention it, delete if so, but if you are over worried, then you could always try a scan with other software that can be installed alongside avast, such as malwarebytes. Its good freeware, does not conflict with avast, and I use it as my secondary anti-malware program (if one plays up, I can scan the system using the other) http://www.malwarebytes.org/products/malwarebytes_free (http://www.malwarebytes.org/products/malwarebytes_free)

Im sure the warnings everyone is experiencing at the moment are likely not to be anything to worry about, and will be fixed soon enough
Title: Re: Is this a fake Avast update or download?
Post by: beruco on February 19, 2012, 05:44:16 AM
I have de same problem with the adress http://download117.avast.com/iavs5x/vps_32-72b-72a.vpx.
Title: Re: Is this a fake Avast update or download?
Post by: Nobneb on February 19, 2012, 08:39:55 AM
 >:(  just got exactly the same pop up and update warning with infection....5 minute ago just after I switched on my laptop!!
Title: Re: Is this a fake Avast update or download?
Post by: Coolmario88 on February 19, 2012, 08:50:00 AM
Try updating avast through the UI  if you can't try download this update manually file  from http://files.avast.com/iavs5x/vpsupd.exe (direct link for avast version 5 and 6 users)

Edit: I think avast fixed the problem because i just went to the link avast was blocking from download117.avast.com and i didn't get the virus alert popup.
Title: Re: Is this a fake Avast update or download?
Post by: polonus on February 19, 2012, 08:54:30 AM
Hi forum friends,

Assume this has been fixed,

polonus
Title: Re: Is this a fake Avast update or download?
Post by: Anacunga on February 19, 2012, 10:07:39 AM
Hey Folks, isn't it that kind of "minor issues" showing that AVAST IS REALLY WORKING as it should? I assume that for any reason the update-url got into the list of malicious urls so that AVAST's own update got into trouble and being detected as malware. Sure, is not nice - but with the next update (just following) it was fixed and all is again fine ... :)

Btw: this is harmless - and brings people to really read what the errors avast is reporting are. I remember a similar, but worse kind of problem that really was a bigger issue: once some years ago at night (one'o'clock or else central european time) EVERY running program was considered as malware. If you had set AVAST to automatically delete it you were stuck - but if you did set to ask, you could see what happened. The problem was reported here in the forum - and gone within some one or two hours.

Better that way (to be slightly too strong) than letting through real malware - so AVAST IS REALLY WORKING - and still the best!
Title: Re: Is this a fake Avast update or download?
Post by: scottinaz on February 19, 2012, 02:42:36 PM
I got this today and called them since the forum was not accessible and I was concerned that Avast had been compromised in its own server or something using its own internet connection.

He did a remote look on my computer and insisted it is not Avast but some problem from faulty Windows or some remnant of some other, incompatible program like a registry key left from a long uninstalled Norton that came with the computer.  He said it would be fixed if I paid a windows service tech every couple months to service the computer.  So after 15 or a while minutes that is what he kept saying caused this, or using ccleaner, various things like that so that Avast could not function properly because of a faulty Windows or something from a 3rd party software and thus gave the message others have reported here.

I am not convinced this is the correct cause, but it is what was told to me by the Avast rep on the phone.
Iyogi doesn't know what they are talking about, I wouldn't trust them.
Title: Re: Is this a fake Avast update or download?
Post by: Asyn on February 19, 2012, 02:53:30 PM
I got this today and called them since the forum was not accessible and I was concerned that Avast had been compromised in its own server or something using its own internet connection.

He did a remote look on my computer and insisted it is not Avast but some problem from faulty Windows or some remnant of some other, incompatible program like a registry key left from a long uninstalled Norton that came with the computer.  He said it would be fixed if I paid a windows service tech every couple months to service the computer.  So after 15 or a while minutes that is what he kept saying caused this, or using ccleaner, various things like that so that Avast could not function properly because of a faulty Windows or something from a 3rd party software and thus gave the message others have reported here.

I am not convinced this is the correct cause, but it is what was told to me by the Avast rep on the phone.
Iyogi doesn't know what they are talking about, I wouldn't trust them.

+1
Ignore iYogi, when they try to sell you some additional stuff..!!!
You always get the best advice for free here. ;)
Title: Re: Is this a fake Avast update or download?
Post by: skeptical1 on February 19, 2012, 03:22:40 PM
This is not "fixed" yet. It just happened to me. In my opinion, it is a marketing gimmick using a false flag warning, because when you click on "show details", it takes you to a page that tries to get you to upgrade to the paid version. Otherwise, why would they block their own URL?
Title: Re: Is this a fake Avast update or download?
Post by: Asyn on February 19, 2012, 03:25:22 PM
This is not "fixed" yet.

It should be fixed. Any screenshot..?
Title: Re: Is this a fake Avast update or download?
Post by: skeptical1 on February 19, 2012, 03:37:12 PM
This is not "fixed" yet.

It should be fixed. Any screenshot..?

 No screenshot. The popup disappears after a several seconds. I stand by my original opinion that it's a marketing gimmick. I scanned the URL "download117.avcast.com" at urlvoid.com, and it came back clean.
Title: Re: Is this a fake Avast update or download?
Post by: =SKY= on February 19, 2012, 03:49:15 PM
(http://dl.dropbox.com/u/589618/ZScreen/2012-02/Screenshot-2012-02-18_17.28.41.png)
Same popup here a few seconds ago!!! ???
Title: Re: Is this a fake Avast update or download?
Post by: Vlk on February 19, 2012, 03:52:25 PM
This is indeed a FP and it was already fixed in the latest defs.

FYI, It was an IP address block (as opposed to a domain name block); the reason for it was that the same IP address was obviously used for some malicious purposes in the past (before it got allocated by the hosting provider to our server).

Pretty interesting, sort of like you buy a house and then a bunch of thugs knock on your door because the previous owner owed them some money. :)

Cheers
Vlk
Title: Re: Is this a fake Avast update or download?
Post by: scottinaz on February 19, 2012, 03:55:11 PM
This is indeed a FP and it was already fixed in the latest defs.

FYI, It was an IP address block (as opposed to a domain name block); the reason for it was that the same IP address was obviously used for some malicious purposes in the past (before it got allocated by the hosting provider to our server).

Pretty interesting, sort of like you buy a house and then a bunch of thugs knock on your door because the previous owner owed them some money. :)

Cheers
Vlk

LOL, Perfect Analogy !
Title: Re: Is this a fake Avast update or download?
Post by: =SKY= on February 19, 2012, 04:08:48 PM
This is indeed a FP and it was already fixed in the latest defs.
VlK, NOW I'm relaxed! ;)
Thank you for the information!

Pretty interesting, sort of like you buy a house and then a bunch of thugs knock on your door because the previous owner owed them some money. :)
Lol... ;D
Title: Re: Is this a fake Avast update or download?
Post by: skeptical1 on February 19, 2012, 04:44:42 PM
This is indeed a FP and it was already fixed in the latest defs.

FYI, It was an IP address block (as opposed to a domain name block); the reason for it was that the same IP address was obviously used for some malicious purposes in the past (before it got allocated by the hosting provider to our server).

Pretty interesting, sort of like you buy a house and then a bunch of thugs knock on your door because the previous owner owed them some money. :)

Cheers
Vlk

Thanks Vlk. That sounds plausible. Isn't there some way the hosting provider could scan the IP addresses it allocates with avast before they re-use them? It sounds like it would be an easy way to prevent false positives.
Title: Re: Is this a fake Avast update or download?
Post by: drew316 on February 19, 2012, 06:54:48 PM
Re:  "Im not sure if I can mention it, delete if so, but if you are over worried, then you could always try a scan with other software that can be installed alongside avast, such as malwarebytes."

The avast guy on the phone lectured me that malwarebytes cannot be on the same computer as avast, even if mb is not running or is just a left-over registry key after it is uninstalled, and would cause such a popup malfunction. (It was all about how I had messed up my system somehow to cause this; I think they are trained incorrectly to blame the user?) But that is what he said about mb.
Title: Re: Is this a fake Avast update or download?
Post by: anonymous001 on February 19, 2012, 07:00:59 PM
Re:  "Im not sure if I can mention it, delete if so, but if you are over worried, then you could always try a scan with other software that can be installed alongside avast, such as malwarebytes."

The avast guy on the phone lectured me that malwarebytes cannot be on the same computer as avast, even if mb is not running or is just a left-over registry key after it is uninstalled, and would cause such a popup malfunction. (It was all about how I had messed up my system somehow to cause this; I think they are trained incorrectly to blame the user?) But that is what he said about mb.

Unless there was some misunderstanding, the avast! support also said that the Web Shield wouldn't be functional with the free version of avast!

I tested shortly thereafter, and it seems to work with the free version of avast!

Just throwing that out there.

Thank you for the updates, less to worry about (just installed avast! on a freshly formatted computer yesterday when this malware warning notice popped onto the screen.)

Cheers!
Title: Re: Is this a fake Avast update or download?
Post by: Gargamel360 on February 19, 2012, 07:05:24 PM
Re:  "Im not sure if I can mention it, delete if so, but if you are over worried, then you could always try a scan with other software that can be installed alongside avast, such as malwarebytes."  The avast guy on the phone lectured me that malwarebytes cannot be on the same computer as avast, even if mb is not running or is just a left-over registry key after it is uninstalled, and would cause such a popup malfunction. (It was all about how I had messed up my system somehow to cause this; I think they are trained incorrectly to blame the user?) But that is what he said about mb.
Unless there was some misunderstanding, the avast! support also said that the Web Shield wouldn't be functional with the free version of avast!  I tested shortly thereafter, and it seems to work with the free version of avast!
Just throwing that out there.  Thank you for the updates, less to worry about (just installed avast! on a freshly formatted computer yesterday when this malware warning notice popped onto the screen.)   Cheers!
Yeah, you probably talked to iYogi, thats just how smart ( :P ) they are.  Either way, both those statements are false.