Hilarious Web Shield false positive

[Jack Crawford]

Avast Web Shield just aborted my connection to YouTube because it was allegedly infected with a trojan JS:ScriptPE-inf

(fwiw, the video was https://www.youtube.com/watch?v=wh_WGWii7UE)

...I'm pretty sure YouTube's safe. (I hope that I'm not actually the fool in this case and that this isn't a symptom of some larger underlying problem with my browser being infected or something, but I'm fairly certain I'm clean.)

[Asyn]

Hi, just tested your YT link, but didn't get any Avast warning.

[HonzaZ]

Hi,
I also cannot reproduce.
How this can happen:
1. a link in youtube comments pointing to a blocked URL;
2. infected browser (for example extension that we block);
3. MitM attack (router or ISP) injecting blocked URLs to your content.

Does it still happen? Does it happen in a different browser? On a different device in the same network? Does it happen on the same device in a different network?

[mchain]

Hi HonzaZ,

Also cannot reproduce if using FF 66.0.3 but alert if using Avast Secure Browser, active block.  See below:

Only difference in extensions is Windows Defender Browser Protection is in use in ASB.

[HonzaZ]

I have been able to find it in stats database. It is caused by this blocked URL: connermcd[.]com (the website of the author of the video). I am unblocking it now!

[mchain]

Thanks HonzaZ.