Avast Blocking Popular Javascript Libraries

As I web developer I working with a lot of javascript.

For some strange reason AVast has determined that one of the popular javascipt libraries that I use is Malware!!
http://mootools.net/

Now I am unable to even open the files its marked as Malware. I keep getting “Access is denied” messages.
I’ve tried adding the files in question to the Exclusion list but the problem is still occurring.

Has anyone else had this issue? and if so what did they do to resolve it?

Can Avast please fix this issue? to prevent it happening in the future.

Cheers,
Mark

What is the tools URL ?
When you give it change http to hXXp so the link isn’t active.

What is the malware name given ?

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

Thanks David!

I ran the VirusTotal check and it came back negative. So I submitted it to avast for analysis re your directions.

I have a feeling it might be related to the javascript compression used.

Thanks again.

Unfortunately compression and other forms of obfuscation on javascript is commonly use bt malware writes to hide from detection, is this is possibly why it was detected, that is why |I asked what the malware name was on detection.

Hopefully it will be quickly corrected (if it is compression as you think then it might be a little more problematic), you can in the meantime exclude it from scans.

The Warning I get is:

Malware Name: JS:CVE-2009-0075-E [Expl]
Malware Type: Exploit
VPS Version: 090323-0, 23/03/2009

It’s appears to be a well-known vulnerability.

http://community.ca.com/blogs/securityadvisor/archive/tags/CVE-2009-0075/default.aspx

On which file, exactly?

I’ve tried to download all three forms of MooTools (http://mootools.net/download), but nothing get caught.

FP, will be fixed in next release

Just a quick note - this does not happen on unmodified motools, as downloaded from the web.

Thanks again guys, its great to see how fast you respond to these issues.