Author Topic: avast detects wikipedia as virus  (Read 15074 times)

0 Members and 1 Guest are viewing this topic.

Offline mathboyx215

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 449
avast detects wikipedia as virus
« on: December 27, 2008, 01:01:47 AM »
i was on wikipedia then a avast warning pops up telling me about HTML:iframe-gen virus/worm.

i also made a video about it : http://www.youtube.com/watch?v=cMqEy3ZHRxg&fmt=18

here is the link to the wikipedia page that i was on : http://en.wikipedia.org/wiki/Hunan_Satellite_Television

so is that a false positive or is that really a worm?if its a FP can you fix it in next update?
« Last Edit: December 27, 2008, 01:17:44 AM by mathboyx215 »
It is not possible to divide anything by zero

Jtaylor83

  • Guest
Re: avast detects wikipedia as virus
« Reply #1 on: December 27, 2008, 03:15:37 AM »
False Positive. Dr. Web's Online Check says it's clean. I hope Alwil fixes it.
« Last Edit: December 27, 2008, 03:24:28 AM by Jtaylor83 »

Jahn

  • Guest
Re: avast detects wikipedia as virus
« Reply #2 on: December 27, 2008, 04:19:45 AM »
i was on wikipedia then a avast warning pops up telling me about HTML:iframe-gen virus/worm.

i also made a video about it : http://www.youtube.com/watch?v=cMqEy3ZHRxg&fmt=18

here is the link to the wikipedia page that i was on : http://en.wikipedia.org/wiki/Hunan_Satellite_Television

so is that a false positive or is that really a worm?if its a FP can you fix it in next update?
Hi mathboyx215 and welcome to the forum.

Does Avast still detect this page on your system? I followed the procedure you used in your video, and Avast doesn't detect anything. Try updating Avast and retesting. I see it was VPS version: 081224-0 which detected it. The current version is 081226-0.

Offline mathboyx215

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 449
Re: avast detects wikipedia as virus
« Reply #3 on: December 27, 2008, 05:54:38 AM »
avast is still detecting it


« Last Edit: December 27, 2008, 05:56:30 AM by mathboyx215 »
It is not possible to divide anything by zero

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11828
    • AVAST Software
Re: avast detects wikipedia as virus
« Reply #4 on: December 27, 2008, 11:58:09 AM »
The detected JPEG image has an iframe appended to the file, pointing to some Chinese site.
I don't think it's really a false positive.

Offline mathboyx215

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 449
Re: avast detects wikipedia as virus
« Reply #5 on: December 27, 2008, 03:48:27 PM »
but i have one person who commented on my video saying that he have avast pro and went to that link but nothing happened.so maybe its only happening to me?
It is not possible to divide anything by zero

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11828
    • AVAST Software
Re: avast detects wikipedia as virus
« Reply #6 on: December 27, 2008, 08:02:42 PM »
No, it's not happening only to you - I get the same detection when I visit the corresponding page.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67199
Re: avast detects wikipedia as virus
« Reply #7 on: December 27, 2008, 09:26:50 PM »
Maybe the page is hacked?  ???
avast is very sensible - generally correct detections - on encrypted frames on webpages  ::)
The best things in life are free.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88147
  • No support PMs thanks
Re: avast detects wikipedia as virus
« Reply #8 on: December 27, 2008, 09:31:25 PM »
Most certainly this is no FP the image has been hacked to include an iframe tag at the bottom of the file.

Remember Wiki is user modified so there is a possibility of user images too I guess.

@ Igor
So would this also be considered a type of jpg exploit ?
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.9.6082 (build 23.9.8494.792) UI 1.0.781/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88147
  • No support PMs thanks
Re: avast detects wikipedia as virus
« Reply #9 on: December 27, 2008, 09:33:34 PM »
avast is very sensible - generally correct detections - on encrypted frames on webpages  ::)

Tech it isn't in the page content but is embedded in the actual .jpg image. See the image I posted that is at the bottom of the .jpg viewed in a text editor (editpad lite).
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.9.6082 (build 23.9.8494.792) UI 1.0.781/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline mathboyx215

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 449
Re: avast detects wikipedia as virus
« Reply #10 on: December 27, 2008, 09:36:23 PM »
but why when some people go on the page avast don't detect it?
It is not possible to divide anything by zero

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67199
Re: avast detects wikipedia as virus
« Reply #11 on: December 27, 2008, 09:43:11 PM »
but why when some people go on the page avast don't detect it?
Maybe the avast is not updated? Or well configurated...
For me, the page is set as infected as the picture showed.
The best things in life are free.

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88147
  • No support PMs thanks
Re: avast detects wikipedia as virus
« Reply #12 on: December 27, 2008, 09:52:53 PM »
but why when some people go on the page avast don't detect it?

I don't know and as we only have one person saying they don't have an alert we would need to know what browser, OS and set-up they have as any of those things could lead to it not being detected.

I didn't watch the video (dial-up) so I have no idea what Jahn meant when he said he I followed the procedure you used in your video, and Avast doesn't detect anything.

Now why this didn't alert on one or more, is a different issue, but this detection is IMHO correct, why would a .jpg file be hacked in this way. It is still detected in the latest VPS 081227-0
« Last Edit: December 27, 2008, 09:54:57 PM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.9.6082 (build 23.9.8494.792) UI 1.0.781/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Jtaylor83

  • Guest
Re: avast detects wikipedia as virus
« Reply #13 on: December 27, 2008, 10:27:50 PM »
I think the Wikipedia administrator needs to delete the image or edit the description.


Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88147
  • No support PMs thanks
Re: avast detects wikipedia as virus
« Reply #14 on: December 28, 2008, 12:00:09 AM »
I don't know what there is to edit in the description, that isn't what launches the iframe, but the manipulated .jpg with the embedded iframe tag.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 23.9.6082 (build 23.9.8494.792) UI 1.0.781/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security