Author Topic: False Positive? Avast blocking its own file?  (Read 1153 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
False Positive? Avast blocking its own file?
« on: July 24, 2017, 03:25:08 PM »
Avast File Reputation Warning seems to now be triggering on a file apparently being downloaded by Avast itself.

The message heading reads "The file you are downloading seems to be very new or very rare."
The details are as follows:

File: jre-8u141-windows-x64.exe
Origin: http://asp-cdn-mirror.ff.avast.com/java/jre-8u141-wind...
Digital signature: Not present
Signed by:
Downloaded by: C:\Windows\System32\svchost.exe

This appears to just be a Java Runtime Environment update from Avast's own webserver.
Is this a bug, or am I misinterpreting what I'm reading?

Thanks,
JohnB

Program edition: Avast Internet Security
Program version: 17.5.2303 (build 17.5.3585.182)
Virus definitions version: 170724-2

Offline Milos

  • Avast team
  • Super Poster
  • *
  • Posts: 2294
Re: False Positive? Avast blocking its own file?
« Reply #1 on: July 24, 2017, 03:37:38 PM »
Helo,
as you wrote, by the filename, it looks to be some Java thing and such file should be digitally signed by Oracle and in field "Signed by:" there is nothing. So it looks that downloading was not complete and digital signature is missing/corruted.

If I try to download "asp-cdn-mirror.ff.avast.com/java/jre-8u141-windows-x64.exe" it is downloaded correctly with a valid digital signature. So I guess this was caused by a connection error. Re-downloading should fix it.

Milos