Author Topic: Bug? False positives while browsing web forums  (Read 3261 times)

0 Members and 1 Guest are viewing this topic.

Offline VitorBart

  • Newbie
  • *
  • Posts: 4
Bug? False positives while browsing web forums
« on: January 21, 2007, 01:22:44 PM »
Hi there,

I´m running Avast! Home Ed. 4.7.892 on my desktop and I´ve noticed that everytime it finds the string f o r m a t c : / u / a u t o t e s t > n u l on a web page it causes my system to crash when Avast! warns me that a Trojan Horse - BV:PT [Trj] - was found.



Obviously there is a problem here since I know that the forums I browse are not infected. I´m pretty sure that this false positives occurs only when strings like that are found (especially typed by malicious users who are aware of this odd Avast behavior) on webpages of any kind.

What is going on here?

Regards,
VB
« Last Edit: January 21, 2007, 01:30:42 PM by VitorBart »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Bug? False positives while browsing web forums
« Reply #1 on: January 21, 2007, 01:45:34 PM »
Can you post both your WebShield and your Behavior Block settings as below?
The best things in life are free.

Offline VitorBart

  • Newbie
  • *
  • Posts: 4
Re: Bug? False positives while browsing web forums
« Reply #2 on: January 21, 2007, 07:42:37 PM »
Yes sir, here we go:







Don´t worry about the language pack; everything (buttons, commands, texts) mean exactly the same.

Thanks!
VB

Offline VitorBart

  • Newbie
  • *
  • Posts: 4
Re: Bug? False positives while browsing web forums
« Reply #3 on: January 24, 2007, 03:05:27 AM »
More ideas, any one??

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Bug? False positives while browsing web forums
« Reply #4 on: January 24, 2007, 11:47:38 AM »
Don´t worry about the language pack; everything (buttons, commands, texts) mean exactly the same.
I'm the translator  ;D
I can understand the Brazilian language for sure  8)

Vitor, I can't do more... if it is a false positive, only Alwil team could correct this. I hope they do it soon.
The best things in life are free.

Offline Spyros

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 1139
Re: Bug? False positives while browsing web forums
« Reply #5 on: January 24, 2007, 12:25:12 PM »
Maybe this is the problem?

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Bug? False positives while browsing web forums
« Reply #6 on: January 24, 2007, 01:42:26 PM »
Maybe this is the problem?
Yes it's a problem... but it's not a false positive... I see no reason for that text being there...
If Vitor wants to access that website he must add it to the WebShield exclusion list.
The best things in life are free.

Offline VitorBart

  • Newbie
  • *
  • Posts: 4
Re: Bug? False positives while browsing web forums
« Reply #7 on: January 24, 2007, 02:13:09 PM »
Isso não faz sentido. Como pode uma string tão chulé dessas acionar a proteção contra malwares?? Já que você não a enquadrou como falso positivo, eu presumo que sob algumas circunstâncias/sistemas essa string pode evidentemente fazer algum mal. Quando exatamente?

It doesn´t make any sense. How come such a dumb string like actually triggers the malware protection?? Since you stated it´s not a false positive, I assume that under right circumnstances/OS this string can actually be harmful. Exactly when?

Que mico, vc brasileiro e eu arranhando o inglês ho ho ho  ::)

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Bug? False positives while browsing web forums
« Reply #8 on: January 24, 2007, 02:18:19 PM »
It doesn´t make any sense. How come such a dumb string like actually triggers the malware protection??
Well... the string does not make sense... avast can't know that.

Since you stated it´s not a false positive, I assume that under right circumnstances/OS this string can actually be harmful. Exactly when?
When it is executed... you'll get your harddisk formated.

Que mico, vc brasileiro e eu arranhando o inglês ho ho ho  ::)
Anyway, English-only forum  8)

P.S. I'm an user like you, I'm not from Alwil team, so YOU here should be changed to THEY.
The best things in life are free.