Author Topic: Avast Network Shield is blocking safe image files from Minus.com  (Read 14755 times)

0 Members and 1 Guest are viewing this topic.

Offline OhMyGod

  • Jr. Member
  • **
  • Posts: 23
  • Howdy!
    • Security Software Updater Forums
This just starting happening today as before Minus.com image files were never blocked.
I temporary moved my image files to Limepic.com the exact same images and Network Shield no longer detects them as as malware.

There is no exclusion settings for Network Shield, so everyone who uses Minus.com to host their image files can not access them with Network Shield enabled.

I hope Avast can fix this false positive soon.

Thanks. :)
« Last Edit: October 16, 2011, 09:33:16 PM by OhMyGod »
Security Software Updater Forums
http://ssupdater.b1.jcink.com

Offline akrolsmir

  • Newbie
  • *
  • Posts: 1
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #1 on: October 16, 2011, 09:43:36 PM »
I'm getting this same problem as well. Is minus really infected or is avast just messing up?

Offline bigspanner

  • Jr. Member
  • **
  • Posts: 58
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #2 on: October 16, 2011, 09:44:32 PM »
Can someone in Avast please explain why Minus.com is blacklisted by the Network Shield?

I did a virustotal.com on the Minus.com url and it comes up clean.

http://www.virustotal.com/url-scan/report.html?id=e2355e0d392dddc4eae525f2bc4689b2-1318785836

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85959
  • No support PMs thanks
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #3 on: October 16, 2011, 09:53:46 PM »
Generally the malicious site blocking is very accurate, and if there are a lot of web shield alerts on the site, malicious uploads of the site getting hacked. The end result is the comminitIQ function reports these and it gets added to the Network Shield.

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Press (Media), issues.

- If you are reporting an FP, then you get another input field open, click Browse button and navigate to the file or enter the web URL for the site you wish to submit for Network Shield review, etc. A link to this topic also wouldn't hurt.

@@@@
It doesn't look like the whole minus.com domain is blocked, as I was able to visit the main site (image2). So it may be only this sub-domain that is blocked.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline bigspanner

  • Jr. Member
  • **
  • Posts: 58
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #4 on: October 16, 2011, 10:10:18 PM »
@DavidR,

Sucuri.net also reported that the url is clean.

It seems Avast is blocking everything on Minus.com except its main domain.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85959
  • No support PMs thanks
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #5 on: October 16, 2011, 11:14:17 PM »
I don't know what you input for sucuri.net to scan if you just input http://minus.com (ori.minus.com) it doesn't appear to scan much, it switches to https://minus.com and if you click the triangle to expand the list of what was scanned, it doesn't show a list just the main domain you input and that isn't usual.

See the example if I used forum.avast.com as an example, over 100 items scanned, yet only 1 for minus.com, so I'm really not sure what is or isn't being scanned by sucuri.net.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline OhMyGod

  • Jr. Member
  • **
  • Posts: 23
  • Howdy!
    • Security Software Updater Forums
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #6 on: October 17, 2011, 12:53:52 AM »
Generally the malicious site blocking is very accurate, and if there are a lot of web shield alerts on the site, malicious uploads of the site getting hacked. The end result is the comminitIQ function reports these and it gets added to the Network Shield.

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Press (Media), issues.

- If you are reporting an FP, then you get another input field open, click Browse button and navigate to the file or enter the web URL for the site you wish to submit for Network Shield review, etc. A link to this topic also wouldn't hurt.

@@@@
It doesn't look like the whole minus.com domain is blocked, as I was able to visit the main site (image2). So it may be only this sub-domain that is blocked.

I already filled out the contact form to report this false positive.
Only [http://i.minus.com] is getting blocked which hosts the images.
It is definitely a false positive probably from a recent signature update.

The domain is clean.

Thanks. ;D

« Last Edit: October 17, 2011, 03:14:46 AM by OhMyGod »
Security Software Updater Forums
http://ssupdater.b1.jcink.com

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85959
  • No support PMs thanks
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #7 on: October 17, 2011, 01:18:51 AM »
Even if you consider it a false positive - Please 'modify' your post change the URL from http to hXXp, to break the link and avoid accidental exposure to suspect sites, thanks.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Sneakyone

  • Newbie
  • *
  • Posts: 1
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #8 on: October 17, 2011, 01:36:11 AM »
I'm having the same problem. Images hosted on minus.com's i.minus.com subdomain are getting blocked as a malicious url. This has never happened before and I, a security analyst, have never had any problems with the site and I would appreciate if i.minus.com/108.59.10.222 could be removed from your database as a malicious URL.

Thanks,
Sneakyone

Offline OhMyGod

  • Jr. Member
  • **
  • Posts: 23
  • Howdy!
    • Security Software Updater Forums
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #9 on: October 17, 2011, 01:40:08 AM »
Even if you consider it a false positive - Please 'modify' your post change the URL from http to hXXp, to break the link and avoid accidental exposure to suspect sites, thanks.

I have disabled Network Shield and downloaded several images and Avast doesn't detect any malware.
Which leads me to believe it is a just bug in the Network Shield. I even checked file hashes from my original images that I uploaded to Minus and they are exactly the same as the ones on my computer.

If the images are the same ones that I uploaded they can't be infected there is no reason Network shield should block them.

Thanks. ;D
Security Software Updater Forums
http://ssupdater.b1.jcink.com

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85959
  • No support PMs thanks
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #10 on: October 17, 2011, 02:16:20 AM »
That doesn't change the point raised, about posting active links to suspect sites, regardless of the fact you think it is a false positive. It is just a bad habit to get into when reporting any suspect site.

So please understand why we suggest that and modify your post.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline OhMyGod

  • Jr. Member
  • **
  • Posts: 23
  • Howdy!
    • Security Software Updater Forums
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #11 on: October 17, 2011, 03:22:12 AM »
That doesn't change the point raised, about posting active links to suspect sites, regardless of the fact you think it is a false positive. It is just a bad habit to get into when reporting any suspect site.

So please understand why we suggest that and modify your post.

I modified the link just to make you happy, but its not that I think it is a false positive, I know that it is a false positive.

Minus.com has replied to my email that I sent them. They said their site is safe and there is no security threats on their domains, they have contacted Avast to resolve this issue. I have no reason to doubt them since I have been using their services for many years.

Still waiting on Avast to reply to my email.

Good day. ;D
Security Software Updater Forums
http://ssupdater.b1.jcink.com

Offline kubecj

  • Avast team
  • Advanced Poster
  • *
  • Posts: 1123
    • ALWIL Software
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #12 on: October 17, 2011, 10:41:05 AM »
Infected exe, random filename and oversensitive heuristics. It was fixed few minutes ago.
Jindrich Kubec

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 85959
  • No support PMs thanks
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #13 on: October 17, 2011, 01:23:42 PM »
<snip>
I modified the link just to make you happy, but its not that I think it is a false positive, I know that it is a false positive.
<snip>

I know you know that you believe it to be a false positive, but you would be very surprised by the number of people stating exactly the same and sites claiming to be clean, when the reverse is correct. This is why we suggest breaking the links, thanks for modifying your link.

You now have your answer in the topic from 'kubecj' of the virus labs.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.9.2494 (build 21.9.6698.703) UI 1.0.672/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline minusinc

  • Newbie
  • *
  • Posts: 8
Re: Avast Network Shield is blocking safe image files from Minus.com
« Reply #14 on: October 17, 2011, 02:02:56 PM »
Hi

John here from Minus. Please unblock our URL and we'll remove the viruses in question. If there are any questions please email info@minus.com or to report any issues.

Urgently awaiting response.

Thanks