Avast! blocking PCLinuxOS Magazine site. FP ?

Viruses and worms
1

Topic thread:
http://www.pclinuxos.com/forum/index.php/topic,121819.msg1019246.html#msg1019246

Avast! is reporting the PCLinuxOS Magazine cover, and its site as malware for about 4 days now.

The Report: (Spanish sorry) http://bit.ly/15QgYqH

http://www.pclinuxos.com/forum/index.php/topic,121819.msg1019334.html#msg1019334

It appears to me that Avast is regarding the entire magazine site as a malicious URL, and is blocking the graphic for that reason. Any effort to visit the magazine site, view the HTML version, or to download a PDF from the PCLOS home page, is blocked completely.
[b] Magazine site is here:[/b] http://pclosmag.com/index.html I simply said to update their database, and that I'd report it. ???

Being a Linux Forum, and myself a PCLinuxOS user, thought best to post in here as I’m out of practice with this stuff, plus shame Avast! reported the Magazine as Malware obviously, being the 10th anniversary of the Distro. :wink:

http://www.pclinuxos.com/forum/index.php/topic,121818.msg1019543.html#msg1019543

Hmm maybe this has already been mentioned, avast says threat detected http://pclosmag.com/Images/Covers/2013-09-600.jpg Infection Blocked URL: http://pclosmag.com/html/enter.html Infection: URL:Mal

Interested if anyone else gets a malware report on the Magazine site, or images.
http://pclosmag.com/Images/Covers/2013-09-600.jpg
URL: http://pclosmag.com/html/enter.html

Be nice to report that it is an Avast! False Positive, however Avast! persists in blocking Windows users accessing the site. :stuck_out_tongue:

Thanks for your time.

Regards,

Tony

2

URL:mal means the URL is on a block list

the IP 190.120.232.165 is listed at BarracudaCentral
http://www.barracudacentral.org/lookups/lookup-reputation

Why is my IP listed on the Barracuda Reputation System?
http://www.barracudacentral.org/lookups/reason

3

Hi Abraxas,

Pondus answered all of your questions here. Thanks, Pondus. Some more observations, but that does not really matter now
or just may underline the same message.
I have reported it from that link directly to avast! with a link reporting to this very thread.
A URL:Mal detection is a general avast! detection for a malware site or site with more sites on the same individual IP

see: http://www.dnstrails.com/tools/lookup.htm?ip=190.120.232.165&date=recent → domains to be checked separately…
and consider this vital info: http://www.ntunhs.net/cgi-bin/whois20_1.cgi & http://hosts-file.net/default.asp?s=190.120.232.165
Probably FP, see: https://www.virustotal.com/en/url/15bcd3147566c4d80efe38d19c6da0430ca40a3befe9eb83901258fd3a103fb7/analysis/1381419236/

greets,

Damian

4

Thankyou for your feedback guys.

I’ll point the facts out to the relevant person(s).

Regards,

Tony

5

This issue with Avast! blocking the PCLinuxOS Magazine site is still happening. :-[
I just scanned the URL again at VirusTotal which says all is o.k., and same results as before.
https://www.virustotal.com/en/url/15bcd3147566c4d80efe38d19c6da0430ca40a3befe9eb83901258fd3a103fb7/analysis/

WOT (The Firefox Addon) is now declaring the page as risky also. :stuck_out_tongue:

I’m pretty certain that the site, and said Pics are all Malware free, many people have checked them with alternate AV’s and tests.

With Avast! still deeming both as risky and blocking them to Windows/Avast! users, a reputation that the site is bad is occurring which is very unfortunate.

Many folk have reported the website and pictures as a false positive through Avast!.
I’m becoming uncomfortable trying to declare that said URL and Pics are OK.

http://pclosmag.com/Images/Covers/2013-09-600.jpg
http://www.pclosmag.com/

URL: http://www.pclosmag.com/ Infection: URL:Mal2
[b]Topic:[/b] Virus detected on pclinuxos.com home page and pclosmag.com http://www.pclinuxos.com/forum/index.php/topic,121994.msg1019965.html?PHPSESSID=93a48e3e8a783b0ad3ecf8f825bec00a#msg1019965

Is there really a problem ?

How does Avast! resolve such a problem ?
I’m saddened that it is continually getting rubbished at the PCLinuxOS Forum, with so many starting threads and asking if there’s an issue.

Regards

Tony

6

IP is now removed from BarracudaCentral block list

7
IP is now removed from BarracudaCentral block list
If that means Avast! stops reporting http://www.pclosmag.com/ as a threat, that's good news !
8

Alas still flagged as URL:Mal by avast! Network Shield,

pol

9

I suggest that a Formal request will be made directly to Avast! therefore to rectify the situation.

10

Were should I submit this problem to Avast! ?

I’m here: https://support.avast.com/Tickets/Submit

However there may be a more direct route I can take. ???

Thanks for any help with this. :slight_smile:

11

You can report a possible FP here: http://www.avast.com/contact-form.php

12
You can report a possible FP here: http://www.avast.com/contact-form.php

Thankyou Asyn. :slight_smile:

I had some time earlier today and looked through the options to report to Avast! and decided on “Contact Us”. :smiley:
I ended up doing just as you suggested and just got an Email from Avast!.

Thank you for contacting us. This is an automated response confirming the receipt of your ticket. One of our agents will get back to you as soon as possible. For your records, the details of the ticket are listed below. When replying, please make sure that the ticket ID is kept in the subject line to ensure that your replies are tracked appropriately.

Ticket ID: UBY-823-39093
Subject: {VIRUS-FALSE} Message from contact form - “False positive website”
Department: Virus
Type: Issue
Status: Received
Priority: Normal

Hoping this will do the trick, has been quite odd to have so many complaints from Linux users who use Avast! and Windows, lol. You have to laugh. ;D

13

You’re welcome.