Author Topic: Network Shield keeps blocking a good website.  (Read 15631 times)

0 Members and 1 Guest are viewing this topic.

english teacher

  • Guest
Network Shield keeps blocking a good website.
« on: October 24, 2012, 04:37:45 PM »
Hi,
I have a toolbar on my computer for Firefox which AVAST says is bad.
I have had to disable the Network Shield as I'm getting continuous alerts. 
This toolbar is from Nectar.com and is a legit toolbar it is used as a search engine and with it you collect points. These points are credited to your account with them and you use them to buy things in shops etc.

How can I stop the alerts for this toolbar and where do I report it as a false positive? It's not like a virsu where it is blocked in the Vault and you can report it from there.

Thanks

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89260
  • No support PMs thanks
Re: Network Shield keeps blocking a good website.
« Reply #1 on: October 24, 2012, 04:57:13 PM »
If you can post a screenshot of (only) the avast alert window or post the full text from the alert window, change any URL from http to hXXp to prevent accidental exposure to a suspect site.

The toolbar in itself may be legit, that doesn't meant that any sites it may be linked to aren't infected/malicious, that is why we need more info.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

english teacher

  • Guest
Re: Network Shield keeps blocking a good website.
« Reply #2 on: October 24, 2012, 05:15:56 PM »
Hi and thanks for the reply.

Here is the link from the log file. I have cleaned it up a bit as there is personal information in it like account number etc ...

24.10.2012  16:21:06  Network Shield: blocked access to malicious site hXXp://toolbarservice.freecause.com/2.6/?action=rewards_xul&toolid=61465&userid=XXXXXXXXX&username=XXXXXXXXXXX&time=1351088466&hash=4078b38746862f336ed994c8050ce67e&username=XXXXXXXXXXX&session_key=jkhl2345kj2345kj23jsdfgk45&session_id=1 [ C:\Program Files (x86)\Mozilla Firefox\firefox.exe ( 4316 ) ]

Virustotal link scanner says it's also clean as well. This has worked to day up until the latest update of AVAST

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89260
  • No support PMs thanks
Re: Network Shield keeps blocking a good website.
« Reply #3 on: October 24, 2012, 05:48:19 PM »
Avast isn't the only one thinking this site is at least suspect WOT has it as poor reputation, image1.

However, I didn't get an alert on the main domain, but visiting the toolbarservice sub domain results in two alerts by avast (image2&3), on image2 there is a redirection to hXXp://toolbarservice.freecause.com/2.6/.

This scan has two detections, http://www.urlvoid.com/scan/toolbarservice.freecause.com/, the one from WOT plus this one, http://www.avgthreatlabs.com/sitereports/domain/toolbarservice.freecause.com/

Nothing found here though, sitecheck.sucuri.net/results/toolbarservice.freecause.com/.

####
You can ask for it to be analysed/reviewed:
- There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Undetected Malware; Press (Media), issues.

- If you are reporting an FP, then you get another input field open (image4), click Browse button and navigate to the file or enter the web URL for the site you wish to submit for review, etc. A link to this topic also wouldn't hurt.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

english teacher

  • Guest
Re: Network Shield keeps blocking a good website.
« Reply #4 on: October 24, 2012, 06:31:32 PM »
I have contacted both Nectar and Avast about this. So for now thanks for the help. I'll post back what is said by both when they reply.
Thanks once again.

drac3

  • Guest
Re: Network Shield keeps blocking a good website.
« Reply #5 on: October 24, 2012, 06:35:13 PM »
Thanks, i have the same problem with avast blocking freecause, also have the nectar toolbar.

Offline rob24

  • Full Member
  • ***
  • Posts: 113
Re: Network Shield keeps blocking a good website.
« Reply #6 on: October 24, 2012, 06:47:01 PM »
Yep, same with me, with the Nectar freecause toolbar. Opening 'More Details...' on the alert opens up in Chrome for some reason and as I have the Toolbar operational there I had a similar warning. I've had to disable the toolbar on Firefox and Chrome for now.

It was OK earlier today. I shut the computer down and now back to find this a while ago. Pleased someone else found it and not just me  :)
« Last Edit: October 24, 2012, 06:53:14 PM by rob24 »
Intel Core i5 CPU 4 x 3200 Mhz, 8Gb DDR3 RAM, Windows 10 64 bit, Malwarebytes' Anti-Malware 1.6 free, Superantispyware.
Samsung S3 mobile with Avast Mobile Pro and on Lenovo tablet.

Offline rob24

  • Full Member
  • ***
  • Posts: 113
Re: Network Shield keeps blocking a good website.
« Reply #7 on: October 24, 2012, 06:55:15 PM »
I've just looked on Nectar on Facebook and someone there has the problem. The person tried to remove the toolbar and reinstall it but now it doesn't appear in the Extensions.
Intel Core i5 CPU 4 x 3200 Mhz, 8Gb DDR3 RAM, Windows 10 64 bit, Malwarebytes' Anti-Malware 1.6 free, Superantispyware.
Samsung S3 mobile with Avast Mobile Pro and on Lenovo tablet.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33927
  • malware fighter
Re: Network Shield keeps blocking a good website.
« Reply #8 on: October 24, 2012, 06:57:28 PM »
This was the malware found there (now being closed since 2012-04-10 21:53:53)  known as "unknown_html_RFI_php"
htxp://toolbarservice.freecause.com/2.6/?action=version_xml&toolid=100783&userid=&username=&key=&mode=1&v=Bucksbee%20Loyalty%20Plugin%20%2D%20InstallMonetizer%201%2E650
See: http://www.threatexpert.com/report.aspx?md5=08ca3457be9e45259c0767322ecdf8b4
site has conditional redirects (vulnerable to PHP/5.3.15-1~dotdeb.0  bugs)

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Mender

  • Newbie
  • *
  • Posts: 1
Re: Network Shield keeps blocking a good website.
« Reply #9 on: October 24, 2012, 07:09:40 PM »
Same problem here with the Nectar Toolbar. It only started this afternoon and that was before I updated to the latest Avast free. After updating, I still have the same problem. I will report it as a false positive.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89260
  • No support PMs thanks
Re: Network Shield keeps blocking a good website.
« Reply #10 on: October 24, 2012, 07:35:17 PM »
I have contacted both Nectar and Avast about this. So for now thanks for the help. I'll post back what is said by both when they reply.
Thanks once again.

You're welcome, hopefully now any issues have been removed/resolved at the site avast can review the block.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

english teacher

  • Guest
Re: Network Shield keeps blocking a good website.
« Reply #11 on: October 24, 2012, 08:56:55 PM »
I seem to have started something here, haven't I?

Anyway, can somebody tell me how to stop the alerts from popping up for this problem. I don't want to turn the Network Shield off so I've turned off the sound as I'm fed-up of hearing (ahhhhhhh dare I write it ? I can't stand even writing it ahhhhhhhh)
 "DING DING DING Threat has been detected"

Thank you.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89260
  • No support PMs thanks
Re: Network Shield keeps blocking a good website.
« Reply #12 on: October 24, 2012, 09:58:19 PM »
The Network Shield has no user configurable settings, so no excluded URLs option. I certainly wouldn't disable the network shield for any short term gain as it provides a valuable level of protection. It is now up to avast to follow up on your reporting it.

You can try to pause or stop the toolbar as a temporary measure or add the *toolbarservice.freecause.com/* or 174.37.58.233 IP address to your firewall to block access to it, but avast may still get in there before the firewall.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.5.6116 (build 24.5.9153.762) UI 1.0.808/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline mchain

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 5711
  • Spartan Warrior
Re: Network Shield keeps blocking a good website.
« Reply #13 on: October 25, 2012, 01:49:53 AM »
@ drac3, rob24, Mender,

Please see http://forum.avast.com/index.php?topic=107658.msg854389;topicseen   See reply # 3 & 4 there.  You can get the help you need if you start your own topic.  We do not mind the extra work.
Windows 10 Home 64-bit 22H2 Microsoft Windows Defender - Windows 11 Home 23H2 - Windows 11 Pro 23H2 Avast Premier Security version 24.4.6112 (build 24.4.9067.762) UI version 1.0.803

CharleyO

  • Guest
Re: Network Shield keeps blocking a good website.
« Reply #14 on: October 25, 2012, 07:17:35 AM »
***

Thousands of web sites get infected every minute of every day.

Turning off the Network Shield is a definite No-No !


***