Author Topic: False MAL Positive  (Read 1749 times)

0 Members and 1 Guest are viewing this topic.

bwhite01

  • Guest
False MAL Positive
« on: February 21, 2013, 12:41:56 AM »
I am not sure of the proper procedure for reporting a false MAL positive, so I am posting here.

The site is xww.fearlessbaliretreats.com and I think the MAL warning is actually coming from this file: xww.fearlessbaliretreats.com/files/main_style.css

This appears to me a straight-forward CSS file as far as I can tell.

I have checked the site with several other online malware detection tools and they all report the site as clean.

Anything you can do to help would be appreciated.
« Last Edit: February 21, 2013, 08:06:47 AM by Milos »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user
Re: False MAL Positive
« Reply #1 on: February 21, 2013, 12:46:53 AM »
and what is it avast say?.....a screenshot would help

bwhite01

  • Guest
Re: False MAL Positive
« Reply #2 on: February 21, 2013, 07:44:38 PM »
It WAS the standard MAL popup:

Infection Details
URL: http://www.fearlessbaliretreats.com/
Process: C:\Program Files (x86)\Mozilla Firefox 1...
Infection: URL:Mal

But this morning none of the 3 machines tested yesterday are throwing the error. Something must have updated over night.

Thanks

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user
Re: False MAL Positive
« Reply #3 on: February 21, 2013, 08:01:52 PM »
URL:means it is on a block list..

not on any list here
http://www.urlvoid.com/scan/fearlessbaliretreats.com/

so i guess it was FP and they fixed it

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33897
  • malware fighter
Re: False MAL Positive
« Reply #4 on: February 21, 2013, 11:26:58 PM »
Pondus, according to VirusWatch there was unknown html malware on that domain, but that was closed on 2013-02-21 02:19:44 after just 1.2 hrs of activity,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!