Avast Network Shield is blocking safe image files from Minus.com

[OhMyGod]

This just starting happening today as before Minus.com image files were never blocked.
I temporary moved my image files to Limepic.com the exact same images and Network Shield no longer detects them as as malware.

There is no exclusion settings for Network Shield, so everyone who uses Minus.com to host their image files can not access them with Network Shield enabled.

I hope Avast can fix this false positive soon.

Thanks.

[akrolsmir]

I'm getting this same problem as well. Is minus really infected or is avast just messing up?

[bigspanner]

Can someone in Avast please explain why Minus.com is blacklisted by the Network Shield?

I did a virustotal.com on the Minus.com url and it comes up clean.

http://www.virustotal.com/url-scan/report.html?id=e2355e0d392dddc4eae525f2bc4689b2-1318785836

[DavidR]

Generally the malicious site blocking is very accurate, and if there are a lot of web shield alerts on the site, malicious uploads of the site getting hacked. The end result is the comminitIQ function reports these and it gets added to the Network Shield.

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Press (Media), issues.

- If you are reporting an FP, then you get another input field open, click Browse button and navigate to the file or enter the web URL for the site you wish to submit for Network Shield review, etc. A link to this topic also wouldn't hurt.

@@@@
It doesn't look like the whole minus.com domain is blocked, as I was able to visit the main site (image2). So it may be only this sub-domain that is blocked.

[bigspanner]

@DavidR,

Sucuri.net also reported that the url is clean.

It seems Avast is blocking everything on Minus.com except its main domain.

[DavidR]

I don't know what you input for sucuri.net to scan if you just input http://minus.com (ori.minus.com) it doesn't appear to scan much, it switches to https://minus.com and if you click the triangle to expand the list of what was scanned, it doesn't show a list just the main domain you input and that isn't usual.

See the example if I used forum.avast.com as an example, over 100 items scanned, yet only 1 for minus.com, so I'm really not sure what is or isn't being scanned by sucuri.net.

[OhMyGod]

Generally the malicious site blocking is very accurate, and if there are a lot of web shield alerts on the site, malicious uploads of the site getting hacked. The end result is the comminitIQ function reports these and it gets added to the Network Shield.

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Press (Media), issues.

- If you are reporting an FP, then you get another input field open, click Browse button and navigate to the file or enter the web URL for the site you wish to submit for Network Shield review, etc. A link to this topic also wouldn't hurt.

@@@@
It doesn't look like the whole minus.com domain is blocked, as I was able to visit the main site (image2). So it may be only this sub-domain that is blocked.

I already filled out the contact form to report this false positive.
Only [http://i.minus.com] is getting blocked which hosts the images.
It is definitely a false positive probably from a recent signature update.

The domain is clean.

Thanks.

[DavidR]

Even if you consider it a false positive - Please 'modify' your post change the URL from http to hXXp, to break the link and avoid accidental exposure to suspect sites, thanks.

[Sneakyone]

I'm having the same problem. Images hosted on minus.com's i.minus.com subdomain are getting blocked as a malicious url. This has never happened before and I, a security analyst, have never had any problems with the site and I would appreciate if i.minus.com/108.59.10.222 could be removed from your database as a malicious URL.

Thanks,
Sneakyone

[OhMyGod]

Even if you consider it a false positive - Please 'modify' your post change the URL from http to hXXp, to break the link and avoid accidental exposure to suspect sites, thanks.

I have disabled Network Shield and downloaded several images and Avast doesn't detect any malware.
Which leads me to believe it is a just bug in the Network Shield. I even checked file hashes from my original images that I uploaded to Minus and they are exactly the same as the ones on my computer.

If the images are the same ones that I uploaded they can't be infected there is no reason Network shield should block them.

Thanks.

[DavidR]

That doesn't change the point raised, about posting active links to suspect sites, regardless of the fact you think it is a false positive. It is just a bad habit to get into when reporting any suspect site.

So please understand why we suggest that and modify your post.

[OhMyGod]

That doesn't change the point raised, about posting active links to suspect sites, regardless of the fact you think it is a false positive. It is just a bad habit to get into when reporting any suspect site.

So please understand why we suggest that and modify your post.

I modified the link just to make you happy, but its not that I think it is a false positive, I know that it is a false positive.

Minus.com has replied to my email that I sent them. They said their site is safe and there is no security threats on their domains, they have contacted Avast to resolve this issue. I have no reason to doubt them since I have been using their services for many years.

Still waiting on Avast to reply to my email.

Good day.

[kubecj]

Infected exe, random filename and oversensitive heuristics. It was fixed few minutes ago.

[DavidR]

<snip>
I modified the link just to make you happy, but its not that I think it is a false positive, I know that it is a false positive.
<snip>

I know you know that you believe it to be a false positive, but you would be very surprised by the number of people stating exactly the same and sites claiming to be clean, when the reverse is correct. This is why we suggest breaking the links, thanks for modifying your link.

You now have your answer in the topic from 'kubecj' of the virus labs.

[minusinc]

Hi

John here from Minus. Please unblock our URL and we'll remove the viruses in question. If there are any questions please email info@minus.com or to report any issues.

Urgently awaiting response.

Thanks