Avast Free Antivirus : False Alert Prey ?

[Clemens Ratte-Polle]

@Avast
False Positive for a file?

Avast message:
"Avast Antivirus: updater.exe blocked, infected with IDP.Alexa.53 .
c/windows/Prey/versions/1.9.20/bin/"

Screenshot:
https://photos.app.goo.gl/3RaxhbNyjXJPmyEbA
https://photos.google.com/share/AF1QipMDqKP24HVKvgXzHYbj3wjhWDcTKiiDjwLXtgFZ742lSh_gt5W0hmuiwX-aFr3mWg?key=NG1zOXlvQTBfUV9oNkI2WG9yaEJnLUVfN1REUV9R

App : Prey :
www.preyproject.com

ps:
NO file existent, it is in Quarantaine or deleted?
So i cant use your Feedback page o_O :
https://www.avast.com/false-positive-file-form.php#pc
How to get in contact with you then?

[Asyn]

Please attach your screenshot(s), some of us don't follow external links.

[Claudiu7]

some of us don't follow external links.

well, that is your problem......Why not, as long as you are protected by Avast.....

[DavidR]

some of us don't follow external links.

well, that is your problem......Why not, as long as you are protected by Avast.....

You can if you wish and then follow up on the advice.

It is a bit like using your foot as a mine detector.

However, mainly it keeps all of the information in one location within the topic and you aren't having to leave the forum topic for information.

[r@vast]

@Avast
False Positive for a file?

Avast message:
"Avast Antivirus: updater.exe blocked, infected with IDP.Alexa.53 .
c/windows/Prey/versions/1.9.20/bin/"

Screenshot:
https://photos.app.goo.gl/3RaxhbNyjXJPmyEbA
https://photos.google.com/share/AF1QipMDqKP24HVKvgXzHYbj3wjhWDcTKiiDjwLXtgFZ742lSh_gt5W0hmuiwX-aFr3mWg?key=NG1zOXlvQTBfUV9oNkI2WG9yaEJnLUVfN1REUV9R

How to get in contact with you then?

Hi,

Please report it via https://www.avast.com/false-positive-file-form.php
and upload the screenshot instead of the detected file. Avast virus support will get back to you via email/ticket.

[Clemens Ratte-Polle]

@Asyn

Please attach your screenshot(s), some of us don't follow external links.

Sorry, but how to attach an image?
There are only 2 bracket "" which do not show Google image links.
thx

ps: x tries to recognize the verifying letters! o_O

[bob3160]

@Asyn

Please attach your screenshot(s), some of us don't follow external links.

Sorry, but how to attach an image?
There are only 2 bracket "" which do not show Google image links.
thx

ps: x tries to recognize the verifying letters! o_O

Follow this.

[Asyn]

ps: x tries to recognize the verifying letters! o_O

Captcha is only needed for your first 3 posts. (Spam protection)

[Clemens-Ratte-Polle]

i can attach no image attach option at all o_O
Browser Opera, Addon uMatrix all allowed.
I did it by URL with ibb.co

[DavidR]

i can attach no image attach option at all o_O
Browser Opera, Addon uMatrix all allowed.
I did it by URL with ibb.co
<EDIT: Snip image>

I'm just wondering if this is an anti-spam measure, But I'm sure I have seen others with only one to two being able to attach images.  So I'm not sure what has happened here.

Now you have 3 posts you shouldn't get the captcha when posting next time and hopefully not when trying to attach an image.

Note:
You can't put a URL in the attachments and other options, as mentioned in that section images and text files only, see attached image 1.
The image has to be located on your system not in a URL/web location, see attached image 2.

[polonus]

Alert maybe because of a redirects to adware alert(ad-blockers block external links, see: https://quttera.com/detailed_report/www.preyproject.com )
like for this redirect - Required URL:   -https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=182185&time=1649501873547&url=https%3A%2F%2Fpreyproject.com%2F
Required IP:   -13.107.42.14 United States
Redirected URL:   -https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D182185%26time%3D1649501873547%26url%3Dhttps%253A%252F%252Fpreyproject.com%252F%26liSync%3Dtrue
(redirects on MSN-AS-block).

Wait for a final verdict from avast for this to be an FP or a genuine adware PUP alert.
At VT no av-vendor flags the redirect from -px.ads.linkedin dot com as malicious per se.

Also read as background info here: https://community.watchguard.com/watchguard-community/discussion/344/https-proxy-px-ads-linkedin-com-and-chrome
The hick-ups could also be cloud-driven-related.

polonus