Author Topic: Virus on forum or false positive  (Read 28470 times)

0 Members and 1 Guest are viewing this topic.

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Virus on forum or false positive
« on: January 24, 2006, 08:30:34 PM »
I get a virus warning when trying to view this link. I guess it's a false positive on the page?

http://forum.avast.com/index.php?topic=7557.0\PxB1AB8

Quote
Win32:Mhtplo-26 [Trj]
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline CharleyO

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7085
  • Be alert for error code - ID 10T
Re: Virus on forum or false positive
« Reply #1 on: January 24, 2006, 08:48:55 PM »
***

Well, that is surely strange. I also got the virus warning.    :o    ???


***
Self-built desktop (8 years old) - AMD64 3200+_Gigabyte GA-K8NS Ultra-939_4 gb RAM_GeForceFX 5800w/256 ram_XP/SP3_Avast 7_MBAM_ZA Free __and__ Toshiba Satellite Laptop_W7-64bit_ 4 gb Ram_Avast 8_MBAM

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85965
  • No support PMs thanks
Re: Virus on forum or false positive
« Reply #2 on: January 24, 2006, 10:19:19 PM »
Well the DrWeb browser extension doesn't show anything. So it could well be an FP.

Strange thing my browser extension for firefox now displays the info in Russian!
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33376
  • malware fighter
Re: Virus on forum or false positive
« Reply #3 on: January 24, 2006, 10:38:46 PM »
Got the same there Filesize 39220 bytes
PxB1AB8 archive HTML
,,             Javascript.0 - OK
,,             Javascript1.2.1 - OK
,,             OK

Yep, that can be you just have to look for OK or the colour of the Spider green = OK. When the servers are busy sometimes you get the messages in Russian (in that case just reload or scan again), some lucky ones  can have their messages in French even. It means it is rush hour there on their servers.

Wait until the Spider blushes in pink ;D  ;D

polonus
« Last Edit: January 24, 2006, 10:40:22 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Omar

  • Sr. Member
  • ****
  • Posts: 254
Re: Virus on forum or false positive
« Reply #4 on: January 25, 2006, 09:16:20 PM »
 AntiVir     
Found HTML/Exploit.Mhtml script-virus
ArcaVir    
Found nothing
Avast    
Found Win32:Mhtplo-26
AVG Antivirus    
Found nothing
BitDefender    
Found nothing
ClamAV    
Found Exploit.HTML.MHTRedir-8
Dr.Web    
Found nothing
F-Prot Antivirus    
Found nothing
Fortinet    
Found nothing
Kaspersky Anti-Virus    
Found nothing
NOD32    
Found nothing
Norman Virus Control    
Found nothing
UNA    
Found nothing
VBA32    
Found nothing

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: Virus on forum or false positive
« Reply #5 on: January 25, 2006, 09:48:34 PM »
Still detecting even after todays update.

Is there a virus lurking on the forum?

I'm pretty sure is must be a false positive. Is anybody from avast! looking into it?
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: Virus on forum or false positive
« Reply #6 on: January 27, 2006, 06:17:05 PM »
Bump.

Still detecting even after todays update.
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline CharleyO

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7085
  • Be alert for error code - ID 10T
Re: Virus on forum or false positive
« Reply #7 on: January 27, 2006, 06:41:48 PM »
***

Yep ... still detecting it also!


***
Self-built desktop (8 years old) - AMD64 3200+_Gigabyte GA-K8NS Ultra-939_4 gb RAM_GeForceFX 5800w/256 ram_XP/SP3_Avast 7_MBAM_ZA Free __and__ Toshiba Satellite Laptop_W7-64bit_ 4 gb Ram_Avast 8_MBAM

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40610
  • Dragons by Sasha
    • Malware fixes
Re: Virus on forum or false positive
« Reply #8 on: January 27, 2006, 07:11:52 PM »
However it is a good tutorial for people who have never seen webshield at work  ;D

Offline RNfromTN

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 670
  • surfin sandboxed
Re: Virus on forum or false positive
« Reply #9 on: January 28, 2006, 03:06:09 AM »


Strange thing my browser extension for firefox now displays the info in Russian!
Dr. Web  hyperlink scanner in Opera does the same also.
Sandboxie| IFW|Outpost firewall|Norton Ghost|Win XP,Vista,7
member since 2005| Linux Mint user

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85965
  • No support PMs thanks
Re: Virus on forum or false positive
« Reply #10 on: January 28, 2006, 03:03:01 PM »
As polonus mentioned.
Quote
When the servers are busy sometimes you get the messages in Russian (in that case just reload or scan again),
Mine remained in Russian for a day or so and now it is back to English, so hopefully yours will too.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline elodie

  • Newbie
  • *
  • Posts: 3
Re: Virus on forum or false positive
« Reply #11 on: January 28, 2006, 07:38:08 PM »
There is no virus on the webpage linked above.

I guess there is a false positive because of the string " m -s - i -t -s- :-m -h- t- m- l :f i l e-:- / -/   -C-  :-\ - \-M- A-I -N .-M-   H-   T ! h- t- t-p"
(censured in case of I am right ;) )


Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: Virus on forum or false positive
« Reply #12 on: January 29, 2006, 10:12:35 AM »
Bump.

Still detecting even after todays update.

Yes, I thought it must be a false positive of a character string too, but is anybody going to fix it, or at least say that they know about it?
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re: Virus on forum or false positive
« Reply #13 on: January 29, 2006, 10:26:05 AM »
It will be fixed early next week (that is tomorrow or day after tomorrow)

The last night's update was scheduled long time ahead and brought a detection of some 12,000 Trojans (but didn't fix any FP's).

That is also why it was larger than usual (217KB).


Thanks
Vlk
If at first you don't succeed, then skydiving's not for you.

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: Virus on forum or false positive
« Reply #14 on: January 29, 2006, 11:43:02 AM »
Cheers Vlk!
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog