Author Topic: URLs are blocked even with 'Block malware URLs' disabled?  (Read 19713 times)

0 Members and 2 Guests are viewing this topic.

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #15 on: June 26, 2016, 07:49:53 PM »
Disabling URL blocking should let me see the site, or the popup should give me another kind of alert notification for whatever reason Avast then has determined is cause to block.

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #16 on: June 26, 2016, 08:06:39 PM »
That site is bad and not only because of phishing activities.

I'm sure it is. So let Avast scan and check all of it, but let me access the site at my own peril if I so choose.

FYI: I run Avast on several machines. Some of those are virtual machines with more vanilla Firefox. No mixed content blocking (although 47 may do it by default now). No Privacy Badger. Just Adblock Plus. I've disabled Web Shield in one of them and visited the site in question.  Clicked all over the place. Then re-enabled Web Shield, ran a full system scan, ran antispyware tools, the works. No problems found. Seems the phishing is really the offending part (currently). And phishing is hardly a problem if one uses common sense.
« Last Edit: June 26, 2016, 08:09:54 PM by Rundvleeskroket »

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #17 on: June 26, 2016, 08:51:13 PM »
Quote
And phishing is hardly a problem if one uses common sense.
It is very obviously that you don't use common sense.

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #18 on: June 26, 2016, 08:57:06 PM »
Luckily that is not for you to decide. You have stated your concerns. They are duly noted. If you aren't going to contribute to this thread in a helpful fashion, please consider yourself excused. Thank you for your input.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #19 on: June 26, 2016, 09:32:07 PM »
@ DavidR: I have unchecked 'Block reported attack sites' and 'block reported web forgeries' in Firefox :)
<snip>
With the checkbox disabled:



Whilst I might not agree with going to these lengths to visit a highly suspect site (it is your system), but the avast settings/options when set should work and this didn't. First time I disabled only the web shield Enable Web scanning, thinking that should work for all scanning, it didn't and I got the URL:Mal alert.

I can in a way confirm (but not exactly) what you reported, I didn't switch off the settings in firefox - allowing that warning to display and opt to ignore. I disabled not only the Block malware URLs but also Enable Web scanning (Note to readers don't do this if you haven't got a robust backup and recovery strategy in place).

Here is when it starts to get strange, first I didn't get the URL:Mal and URL:Mal2 alert that you posted, but two other popups.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48524
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #20 on: June 26, 2016, 09:32:39 PM »
Why bother using an AV if you don't intend to listen to it's advice ???
If you think the detection  is incorrect, report it and wait for a change in the detection if you're correct.
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #21 on: June 26, 2016, 09:36:14 PM »
Why bother using an AV if you don't intend to listen to it's advice ???
If you think the detection  is incorrect, report it and wait for a change in the detection if you're correct.

This really is a side issue to the fact that the avast web shield settings don't work as expected, regardless of wanting to commit on-line suicide.

We might not agree with it, but the settings should work.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #22 on: June 26, 2016, 10:00:39 PM »
Exactly. The behaviour of this checkbox isn't as expected.

If my AV tells me: "This site might try to scam you", fine, noted. I'll be careful. If it just flat out blocks the site because some people might fall for said scams, at least give me an option to say: "I get it. I understand. Now let me proceed." Make it an advanced option somewhere. I'm perfectly willing to take my chances. I have backups. I have virtual machines. Blocking for viruses is one thing, blocking for phishing is another. I'm fine that Avast does this by default, and on most sites I would have it enabled. But ultimately I decide :)

Ideally I would have URL blocking enabled, except for explicitly added exclusions. So, that option doesn't exist, and the option that does exist doesn't do what it is supposed to do.

It would seem I have stumbled upon a bug then :)
« Last Edit: June 26, 2016, 10:27:57 PM by Rundvleeskroket »

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1038
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #23 on: June 27, 2016, 10:49:26 AM »
Hi all,
You can turn webshield, but the exclusions only work on (JS, HTML, ...) detections on the domain, not the domain itself. To override URL block, you have to disable shields.
DavidR: The 2 popups that you were seeing are from AOS (Avast Online Security, the browser plugin).
"This site could have harmed your computer" is an equivalent of URL:Mal detection, AOS uses the same database for that
"This site has been marked as a phishing site" is a result of our internal phishing database, that is created (loosely) based on Mailshell, Phishtank, APWG and Cyren databases.

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48524
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #24 on: June 27, 2016, 03:01:03 PM »
Hi all,
You can turn webshield, but the exclusions only work on (JS, HTML, ...) detections on the domain, not the domain itself. To override URL block, you have to disable shields.
DavidR: The 2 popups that you were seeing are from AOS (Avast Online Security, the browser plugin).
"This site could have harmed your computer" is an equivalent of URL:Mal detection, AOS uses the same database for that
"This site has been marked as a phishing site" is a result of our internal phishing database, that is created (loosely) based on Mailshell, Phishtank, APWG and Cyren databases.
If I understand this correctly, the only way to bypass a dangerous site is to turn off the Shield.

Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #25 on: June 27, 2016, 11:55:01 PM »
I don't want to turn off the Web Shield. But I do expect that if I disable URL blocking, Avast actually stops blocking URLs (and giving me an alert when I visit a site that it blocked it based on URL --> URL:Mal(2)).

As it stands, disabling that feature doesn't in fact disable it.
« Last Edit: June 27, 2016, 11:56:38 PM by Rundvleeskroket »

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #26 on: June 28, 2016, 12:09:04 AM »
Ha die Rundvleeskroket,

Why you wanna turn of the obvious and reasonable Mal:URL or Mal:URL2 blocking alerts for Pete's sake?
I would keep all protection up and running, not make an exclusion for that website, but visit it using a webproxy of sorts,
like for instance https://whoer.net/webproxy
Whenever you are blocked against something in the code while running a site on a webproxy server,
then you should report back here, because then the site you wanna visit perse is laden with malcode or working something uncanny out into the browser executable.
What does the Google Safebrowsing report on that particular site say, and what do you get scanning it at: isithacked.com

When not enough of the vulnerable or suspicious or even malware code is showing a webproxy is a safe way of going somewhere
to keep a particular threat at bay and not given up the exisiting line of defense and protection.

Ik zou zeggen probeer dit eerst eens uit en dan zien we wel weer, gegroet,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #27 on: June 28, 2016, 12:11:43 AM »
I can visit the site in a dedicated VM if I must. But I'd rather avoid the hassle.

Tell me: what is the point of having a checkbox, if it doesn't matter whether it is checked or not? At the very least the feature should behave as expected. It currently does not.

Het komt er op neer dat ik zelf wel bepaal welke functionaliteit ik wel en niet gebruik, en welke sites ik wel of niet bezoek. Mijn virusscanner is een gereedschap om mijn risico's te mitigeren, en daar maak ik dankbaar gebruik van. Maar dat wil niet zeggen dat ik moet kiezen voor het keurslijf van Avast gericht op klikgrage lui. Ik ben me bewust van de risico's. Blijf vooral waarschuwen dat het gevaarlijk is. Ik weet het. Ik kies er voor om door te gaan. Serieus .. wat moet er gebeuren dat zo spannend is? In het ergste geval zet ik gewoon een image van vorige week terug. Of die van vorige maand. Of die van twee maanden terug. Etc. 10 minuten werk. Desnoods op een andere schijf die ik een stapel heb liggen. Ik vind het vreemd dat ik herhaaldelijk gevraagd word waarom ik het wil doen, want oei oei oei, terwijl ik dat al heb uitgelegd. Ik vind het alleen ook onzin om hele stukken van Avast uit te schakelen terwijl een klein deel een uitzondering geven zou kunnen volstaan. Dan geniet ik het voordeel van de AV, en kan die alsnog als ik daadwerkelijk de site bezoek over de zeik gaan en me waarschuwen.
« Last Edit: June 28, 2016, 12:21:26 AM by Rundvleeskroket »

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #28 on: June 28, 2016, 12:21:11 AM »
Well go watching it in that webproxy shows the site, but also the alert which is for JS:ScrptP-inf[Trj]
The site is redirecting to -http://www.adnetworkperformance.com/a/display.php?r=121020
which should be blocked.

It is malware, read http://www.freefixer.com/b/remove-adnetworkperformance-com-pop-up-ads/
You want that infection because you just like to go to that page?
It is a free world, do as you please. I would use a script blocker then to get away from,
and keep all the fake malware protection off of your machine, these phising guys seems in bed with.

polonus
« Last Edit: June 28, 2016, 12:25:31 AM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Rundvleeskroket

  • Poster
  • *
  • Posts: 508
Re: URLs are blocked even with 'Block malware URLs' disabled?
« Reply #29 on: June 28, 2016, 12:31:02 AM »
Except it isn't!

Yes, if I use the proxy I get the same alert about a trojan. But I just visited the site in a VM. With Firefox and AdBlock Plus. And Avast.

After disabling Web Scanning I can visit the site. I am not redirected anywhere. No popups or popunders. Just the site. Works fine for what I need it for.

I'm not dismissing the risk. Just that it seems acceptable to me. ABP is probably already filtering out the threat.
« Last Edit: June 28, 2016, 01:53:45 AM by Rundvleeskroket »