False Positive Report

Viruses and worms
1

Avast (current virus definitions 180310-00) reports to me as a malicious site www.linuxmind-italia.org.
Performed a test with ‘virustotal’ is clean, and with other antivirus (trendmicro) the site is opened correctly, even with the mobile version of avast.
Yesterday I opened ticket for reporting the false positive (if it can be useful to the staff the email used is the same as registration to this forum), but today despite the virus definitions have been updated, the antivirus continues to block the site, so I decided to open this thread.


https://s18.postimg.org/6vt584ckl/url_mal.png
https://s18.postimg.org/7lbxkhktx/virus_total.png

Vianello

2

→ https://zulu.zscaler.com/submission/90cfd802-b8ba-4e1a-bbf0-cb867d07e54e

3

Interesting, even if I do not understand why other antiviruses are being opened regularly and the total virus that contains a list of antiviruses is reported clean, and the same avast mobile opens the site regularly

Thanks Asyn :wink:

4

You’re welcome.

5

Could be a IP problem, click listed items for details

IP history >> https://www.virustotal.com/#/ip-address/74.220.215.248

6

I reported the link of this 3d to the managers of that site, since the problem seems to me more complex than I suspected

Thanks also to you Pondus

7

Hi,
IP address that was causing linuxmind-italia[.]org being blocked was removed from our blacklist. It will be OK after next streaming update.
Jirka

8

I will have the opportunity to check only in the evening

Thank you Jirka and all your Staff :wink:

Edit at 18.20: Now the site opens correctly.

9

Goodmorning everyone,

I use this my thread to report that avast reports this site to me as malevolent, but doing a virustotal scan is clean.

Website: kolya.convertio.me
Virustotal: https://www.virustotal.com/it/url/881a59201d1088810e7385fb0f6e88405babd5881f0f1f441119a69f54a81042/analysis/1541230942/

I use this site to convert images: https://convertio.co/it/jpeg-gif/, and I often can not use it because it warns me of it malevolent, when I try to convert an image, reporting the site kolya.convertio.me
I ask the Staff if he can verify

Avast version: 18.7.2354
Virus definition: 181102-4


https://i.postimg.cc/TKgk20WR/avast-notify.png

Thank you

Vianello.

10

Hi,
I disabled detection that was probably causing You not being able to convert images. It should be solved after next streaming update. If the problem persists, please let us know.
Jirka

11

Thank you, and I apologize if I answer you after several days

Vianello

12

Goodmorning everyone,

this site that you mark below me indicates it as pishing.
Checks from me are a false positive

Site: www.tivusat.tv
page blocked: https://www.tivusat.tv/pages/news/alert.aspx

https://www.virustotal.com/#/url/61fd1c353e8f80543f3e901c0642d0ddb3e87c05f0294f0e60d8d4032a352dfb/detection

I add: the page that is blocked by the antivirus, tells users that another similar site, this: http://www.tvsat.tv/ is a pishing site.

Antivus: Avast version: 19.1.2360
Definition: 190112-6

13

→ https://sitecheck.sucuri.net/results/https/www.tivusat.tv/pages/news/alert.aspx

Most probably blocked because they mention the phishing URL there.

14

This is the URL Norton safe Web report it on
https://www.virustotal.com/#/url/79b2db1ca58d751e5486122e031070c1a0e41c5443159a95c3db6f84917b4042/detection

15

Only this link is problematic.
https://www.tivusat.tv/pages/news/alert.aspx

All other pages of the site are quietly opened by Avast.
I remember again that page is to warn that another site with a similar url uses phishing activity, so that users are not misled, this page is still ok. I hope the staff will remove the anti-virus ‘block’.

Perhaps the error, as mentioned by Asyn, is to have made the url of the phishing site clickable on that page

Here the virustotal report of this page blocked by the antivirus
https://www.virustotal.com/#/url/5b88d0b28b6f8c2c3424f2cbe48ba2f6f42313e14c7673072a569732d9978f81/detection

Thank you all for the support

Vianello

16

See the security checks here: https://webscan.upguard.com/#/wwww.linuxmind-italia.org

polonus

17

the problem with the linuxmind site has already been solved in last march, now I have this problem

https://forum.avast.com/index.php?topic=217070.msg1490188#msg1490188

Thanks

Vianello

18

Problem is you share an IP with a ransomware tracker IP. for that other website.
Re: https://www.malwareurl.com/ns_listing.php?ip=209.99.64.51

Wait for an avast team member to give a final verdict.
See: https://www.dnsinspect.com/tivu.tv
and consider: https://aw-snap.info/file-viewer/?protocol=secure&ref_sel=GSP2&ua_sel=ff&chk-cache=&fs=1&tgt=d3d3LnRbdnVzfHQudHZgcHxne3Ngbnt3c2B8bHt9dC58c3B4~enc
See: https://retire.insecurity.today/#!/scan/c25c2a5cab3a8fa98247d694d1c786ca57701284d335500899774b9571fa8408
See security recommendations here: https://webhint.io/scanner/f9c42553-fd59-43fe-bf69-d3f9fb35c807#Security

polonus (volunteer website security analyst and website error-hunter)

19

Hello polonius
I am a simple visitor to that site, therefore, as a simple user, the users / collaborators who have preceded me have already explained the possible problem: put that link on that page clickable, as written in this post, asking for a review of the Staff of Avast, like the previous times :wink:
https://forum.avast.com/index.php?topic=217070.msg1490188#msg1490188

20

Disabling the antivirus I realized that the offending link was removed from that page, so if possible I ask the revaluation by the staff.
https://www.tivusat.tv/pages/news/alert.aspx

Thanks

Vianello