avast 4.8 false alarm with Internet Explorer

Avast Free Antivirus / Premium Security
1

Bonjour,
Lorsque je fais un aperçu avant impression d’une page dans un forum, AVAST me signale un « VIRUS ».
Ce « virus » semble n’apparaître que sous certaines conditions, à savoir :
plusieurs vérifications avec plusieurs navigateurs
(INTERNET EXPLORER, FIREFOX, OPERA, etc) et plusieurs logiciels
antivirus (KASPERSKY, NORTON, AVAST, etc).

Seule la combinaison AVAST / INTERNET EXPLORER affiche une alerte lors
de l’aperçu avant impression d’une page du forum IsoBourse.

Cette alerte apparait uniquement lors de l’affichage des publicités de la régie publicitaire du site.

Après vérification sur d’autres sites utilisant la même régie publicitaire, on obtient la même alerte avec la combinaison AVAST / INTERNET EXPLORER lors de l’aperçu avant impression d’une page.

J’ai exécuté AVAST 4.8 en mode ‘minutieux’ sur le répertoire mentionné, puis sur l’ensemble depuis C:\Utilisateurs.… = AUCUN VIRUS

Il ne s’agit donc pas d’un virus mais ceci n’explique pas pourquoi AVAST affiche une alerte.
En espérant que la présente pourra vous être utile !
Cordialement

Hello,
When I make a print preview of a page in a forum, AVAST sends an alarm “VIRUS” found !!!
This “virus” seems to appear under certain conditions, i.e:
Several checks carried out using different navigators (INTERNET EXPLORER, FIREFOX, OPERA, etc.) and different antivirus programs (KASPERSKY, NORTON, AVAST, etc.) showed that;
Only the duo AVAST/INTERNET EXPLORER gives an alert when using the print preview of the current page (forum of the site IsoBourse)!
This “virus” alert only appears when a publicity of the site’s sponsor is displayed.
After checking on other sites using the same sponsor, with the same publicity, if using the combination AVAST / INTERNET EXPLORER, the “virus” alert messages is displayed !

I ran AVAST 4.8 twice, with the selected directory and over the full C:\Users.… directories, = NO VIRUS FOUND.

Obviously, it is not a “virus”, so why AVAST is sending this alert ?

Hoping that this message can be of any help to solve the anomaly.

Best regards

PS: I have a more documented information in a PDF file, how to post it ?

2

I suggest:

  1. Clean your temporary files. Use CCleaner or other tool, for instance.
  2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  3. Use MBAM (or SUPERantispyware or even Spyware Terminator) to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
  4. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  5. Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
  6. Clean your Hosts file (replacing it) with HostsMan tool.
  7. Disable System Restore and then reenable it again.
  8. Immunize your system with SpywareBlaster.
  9. Check if you have insecure applications with Secunia Software Inspector.
3

Thanks “Tech” for your answer,

It looks like it is a lenghty procedure you propose !
However, I ran AVAST fully, several times and there were no problem whatsoever!

Maybe I was not clear enough, but the message occurred when I tried to print a page in a forum.

The site where I was connected is a Professional Forum on a Stock Market Application, (http://www.isobourse.com/)
I contacted them and they observed the same anomaly!

In fact, the following is their comment:

Several checks carried out using different navigators (INTERNET EXPLORER, FIREFOX, OPERA, etc.) and different antivirus programs (KASPERSKY, NORTON, AVAST, etc.) showed that; Only the duo AVAST/INTERNET EXPLORER gives an alert when using the print preview of the current page

Will try again, but truly, I suspect that one of the latest version of Avast created the anomaly (???)

Excuse me if I am wrong - but it is odd that “Isobourse” observed, on a different setup and distant system the same problem !

Murphy is lurking around ?

Best regards

4

Hope they take a look if this is a false positive.