Author Topic: Five false positives on five old .pdf fies?  (Read 2355 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Five false positives on five old .pdf fies?
« on: December 12, 2015, 07:48:38 PM »
Avast free keeps reporting that five of my old .pdf files are infected and wants to delete them. I accept that an AV should be MORE aggressive than TOO PERMISSIVE, but why would it pick up on these very safe files?

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Five false positives on five old .pdf fies?
« Reply #1 on: December 12, 2015, 07:55:17 PM »
It can be there are links in those pdf files that point to non-trusted sites/IP's.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89061
  • No support PMs thanks
Re: Five false positives on five old .pdf fies?
« Reply #2 on: December 12, 2015, 09:29:00 PM »
Avast free keeps reporting that five of my old .pdf files are infected and wants to delete them. I accept that an AV should be MORE aggressive than TOO PERMISSIVE, but why would it pick up on these very safe files?

Generally with More Aggressive, Too Permissive you have an increase in potential for FPs - somewhere there has to be a balance.

You don't say what malware name avast gives these detections ?

It could be that these detections are more generic (detecting multiple malware types with one signature) than specific. A little like your more aggressive comment, but there is no detailed information to confirm or deny.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37532
  • Not a avast user
Re: Five false positives on five old .pdf fies?
« Reply #3 on: December 12, 2015, 09:37:30 PM »
If avast detection say  PDF.UrlMal-inf [Trj]    it means pdf.doc contain clickable links to blacklisted URL(s)




REDACTED

  • Guest
Re: Five false positives on five old .pdf fies? SOLVED!
« Reply #4 on: December 12, 2015, 10:07:14 PM »
Pondus, you nailed it! That's exactly how these five files were reported. I am certain that all links are OK--so I'll flag these five files as safe and that should be the end of it.

Thank you everyone

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: Five false positives on five old .pdf fies?
« Reply #5 on: December 12, 2015, 10:48:00 PM »
I was first ;D