Author Topic: Avast and WPS Office Conflict(SOLVED)  (Read 11688 times)

0 Members and 1 Guest are viewing this topic.

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1130
Re: False Positive Detected
« Reply #15 on: March 16, 2017, 08:44:43 PM »
a) What is HTMLScript-inf and why was it detected as a webpage threat when the pop-up appeared when opening my installed word processing program (the pop-up was not displayed on my browser?)
This is because the "installed word processing program" tried to run JavaScript that was located on a server (specifically, cdn.adinall[.]com/js/ssp.js). Whether that is correct behaviour or not, I cannot say.

b) Since wps.exe 'is' a file on my computer and it was detected as a threat, why wasn't it placed in my Virus Vault?
wps.exe was not detected as a threat - the JS file it tried to download (cdn.adinall[.]com/js/ssp.js) was.

c) Each time I open WPS, the 'Threat Block' message appears; Should I add it as an Exclusion? If so, how? If not, what step should I take?
As I do not have the WPS, or the JS that is being blocked, it is impossible for me to say if it is a false positive (and we should alter the detections) or if it is a true positive (and it should remain blocked and you should contact your admin for further instructions).

d) In general, 'if' a detected threat ever got into my system, I understand that it would start with C:\ (not http') but what would the warning wording be instead of 'Threat Blocked?'
I think the message would be the same, but I am not skilled enough to tell for sure.

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 308
Re: False Positive Detected
« Reply #16 on: March 16, 2017, 08:52:01 PM »
All I know is that WPS is the equiv of Microsoft Word, WPS is installed on my computer, and I have never had an issue opening documents before now.

a)To be clear, the Javascript file that WPS attempted to download, not Wps.exe itself, was a threat, and my computer is not infected because the threat was blocked-Correct?

b) If so, I still do not understand why Javascript has to be downloaded each time I open my Word Processing software.

c) Before yesterday (Wed), the 'Threat Blocked' message had not appeared but now it appears periodically when the software is opened-What would you suggest?
« Last Edit: March 16, 2017, 08:57:32 PM by Spiritual2016 »

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1130
Re: False Positive Detected
« Reply #17 on: March 16, 2017, 09:01:36 PM »
a)To be clear, the Javascript file that WPS attempted to download, not Wps.exe itself, was a threat, and my computer is not infected because the threat was blocked-Correct?
Correct.

b) If so, I still do not understand why Javascript has to be downloaded each time I open my Word Processing software.
Me neither. I am neither familiar with WPS, nor can I access the file it is trying to access.

c) Before yesterday (Wed), the 'Threat Blocked' message had not appeared but now it appears periodically when the software is opened-What would you suggest?
I would suggest calling your admin to ask why WPS is accessing cdn.adinall[.]com/js/ssp.js at all, and if that is normal, why there are 2 chinese URLs loaded from that JS.

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 308
Re: False Positive Detected
« Reply #18 on: March 16, 2017, 09:12:27 PM »
Call what Admin!? I am at home using a personal computer.

WPS is a free packaged bundle of three individual WPS Writer (equiv of Microsoft Word), WPS Presentation (equiv of Powerpoint), and WPS Spreadsheet (equiv of Excel). I opened WPS Presentation and WPS Spreadsheet and the 'Threat Blocked' message appears.

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37031
Re: False Positive Detected
« Reply #19 on: March 16, 2017, 09:14:42 PM »
maybe switch over to Libre office?

LibreOffice  >>  https://www.libreoffice.org/


Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 308
Re: False Positive Detected
« Reply #20 on: March 16, 2017, 09:17:58 PM »
I like WPS because it is small, compact, and the three programs service my needs.

I am emailing their technical support now and seeing what they can do about it.

Each time any of the three software programs are opened, the pop-up appears and it is displayed under 'Notifications.'

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37031
Re: False Positive Detected
« Reply #21 on: March 16, 2017, 09:22:20 PM »
Quote
I like WPS because it is small, compact,
So is libre office

Video  https://www.youtube.com/watch?v=S64aPmRPGTY


Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1130
Re: False Positive Detected
« Reply #22 on: March 16, 2017, 09:23:43 PM »
I am not sure why an Office clone should retrieve content from chinese domains, but I am not knowledgable enough about WPS to tell if it is really malicious or not. It is definitely very suspicious.

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 308
Re: False Positive Detected
« Reply #23 on: March 16, 2017, 09:29:57 PM »
HonzaZ:

I 'might' install Libre Office but I would like to resolve the WPS/Avast conflict first because, up until last night, there was not an issue. The latest versions of Avast and WPS are installed.

I emailed officesupport@wps.com and will provide an update once I receive a response from them. Maybe HonzaZ wants to email them as well since he understands my issue and could probably provide a better description of this issue? :)

-To be clear about a detail, even though Avast is displaying a pop-up 'Threat Blocked' message each time WPS is opened, I can still access my individual files without any issues so what exactly is being 'blocked?'

-I wonder if uninstalling and reinstalling the software will resolve the conflict?
« Last Edit: March 16, 2017, 10:48:23 PM by Spiritual2016 »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37031
Re: False Positive Detected
« Reply #24 on: March 16, 2017, 10:36:25 PM »
I am not sure why an Office clone should retrieve content from chinese domains, but I am not knowledgable enough about WPS to tell if it is really malicious or not. It is definitely very suspicious.
Well WPS office is made by Kingsoft that is Chinese


Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37031
Re: False Positive Detected
« Reply #25 on: March 16, 2017, 10:40:03 PM »
Quote
I can still access my individual files without any issues so what exactly is being 'blocked?'
on avast popup  Object: xxxxxxxxxx     is whats blocked



Quote
What is this HTMLScript-inf Infection?
https://www.im-infected.com/virus/htmlscript-inf.html


« Last Edit: March 16, 2017, 10:42:51 PM by Pondus »

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 308
Re: False Positive Detected
« Reply #26 on: March 16, 2017, 11:34:25 PM »
HonzaZ:

I 'might' install Libre Office but I would like to resolve the WPS/Avast conflict first because, up until last night, there was not an issue. The latest versions of Avast and WPS are installed.

I emailed officesupport@wps.com and will provide an update once I receive a response from them. Maybe HonzaZ wants to email them as well since he understands my issue and could probably provide a better description of this issue? :)

-To be clear about a detail, even though Avast is displaying a pop-up 'Threat Blocked' message each time WPS is opened, I can still access my individual files without any issues so what exactly is being 'blocked?'

-I wonder if uninstalling and reinstalling the software will resolve the conflict?

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 308
Re: False Positive Detected
« Reply #27 on: March 17, 2017, 04:30:44 AM »
HonzaZ: Are you around to respond to my latest posting? :)

Offline HonzaZ

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1130
Re: False Positive Detected
« Reply #28 on: March 17, 2017, 06:18:20 AM »
I 'might' install Libre Office but I would like to resolve the WPS/Avast conflict first because, up until last night, there was not an issue. The latest versions of Avast and WPS are installed.
That is another suspicious thing - why didn't it try to connect to those domains earlier than yesterday?

I emailed officesupport@wps.com and will provide an update once I receive a response from them. Maybe HonzaZ wants to email them as well since he understands my issue and could probably provide a better description of this issue? :)
I do not plan to, but feel free to quote my posts if you want to.

-To be clear about a detail, even though Avast is displaying a pop-up 'Threat Blocked' message each time WPS is opened, I can still access my individual files without any issues so what exactly is being 'blocked?'
Once again, a Javascript file at this location: cdn.adinall[.]com/js/ssp.js

-I wonder if uninstalling and reinstalling the software will resolve the conflict?
There is always a possibility, and you lose nothing by trying.

Offline Spiritual2016

  • Sr. Member
  • ****
  • Posts: 308
Re: False Positive Detected
« Reply #29 on: March 17, 2017, 07:03:39 AM »
Does Avast, WPS, or both have to provide a patch/update in order to resolve this conflict?

Since the threat is blocked each time, is it safe to keep using WPS while waiting for their Tech Team to respond?

Is it odd that the path to WPS.exe is C:\Users and not either C\Program Files or C:\Program Filesx86 (Since I am using Windows 7 x64 and have both folders)?
« Last Edit: March 17, 2017, 07:15:21 AM by Spiritual2016 »