Avast went completely berserk blocking age old programs...

Viruses and worms
1

I did not do that much of damage as the latest virus update cured it, but avast removed my Webwasher Mailwasher program I had for ages and also moved ChromePrivacyGuard to the chest. Happily it did not remove Outlook, but the aftermath could be far worse if it had not been repaired with the next update soon to follow. What happened avast! removed these false positives through one of the Shields?

polonus

2

I managed to send one of the programs ChromePrivacyGuard to avast as a FP and it says Infected Files - no virus - FileID 102
What does that mean?

polonus

3

hello

this is how cloud detections . Only for shields scan, not for on demand a scan avast not finding anything.

Send File put in format zip or RAR

to report it as “False positive” to virus@avast.com or through quarantine

Submitting files from the Virus Chest to AVAST Virus Lab

http://www.avast.com/faq.php?article=AVKB21#idt_07

4

Did so and there were no flags.
Did a complete scan of my users file and that did not show nothing either.
So closing this chapter as a one time incident.

Did a complete scan with MBAM/SAS/and the non-resident McAfeeSecurityScan Plus,
the last found two site threats: chromeplugins.org
re: http://www.mcafee.com/threat-intelligence/domain/?domain=chromeplugins.org
Supported by these Norton Community Reviews: http://safeweb.norton.com/reviews?url=chromeplugins.org
e.g. intrusion attempts reported
AVG reports:

Surf with caution
No potential malware has been detected on this website for 7 days. However, potential threats appeared at some point during the last 30 days.

Google Safebrowsing even reports: http://www.google.com/safebrowsing/diagnostic?site=chromeplugins.org
There is a Sucuri Warning for Wordpress internal path: /home/chromepl/public_html/wp-content/themes/thesis/index.php
This scanner flags it as safe: http://check.gred.jp/WebscanAction.action
Also: http://zulu.zscaler.com/submission/show/e605d3bf2719609fe92b073d4835a0df-1381580695
Also consider: http://unblocksit.es/unblock/chromeextensions.org/
This is an insecurity on the site that Quttera detects:
s3.buysellads.com/ac/bsa.js
Severity: Potentially Suspicious
Reason: Detected procedure that is commonly used in suspicious activity.
Details: Too low entropy detected in string [[‘
<span class=’]] of length 1797 which may point to obfuscation or shellcode.
Threat dump: → http://jsunpack.jeek.org/?report=63407b948b07abb23beac57ebcd28912fd9a0921 (open with NS/RP active and in a VM/sandbox)
File type: ASCII
MD5: D10EF6A1A9CC4554054DB0C78D2D2E07
Scan duration[sec]: 1.356000

& rapnostress.com (the second via a scan)

polonus