False positive website

General
1

Hello,

I am posting here because our situation has become extremely serious.

Our website https://rominfomedia.rs/

has been incorrectly blocked by Avast for over a month

Multiple independent security scans (Sucuri, Google Safe Browsing, McAfee, ESET, VirusTotal) confirm the site is 100% clean.

We submitted the official false positive report weeks ago and also contacted Avast Premium Support.
We received no resolution and no update, and the detection is still active.

This false positive has now caused tens of thousands of euros in financial losses to our business.
We urgently need this case escalated to Threat Labs / Engineering, as the situation is no longer sustainable.

Please help us escalate this issue internally.
We cannot continue to operate under these conditions.

Thank you…

2

First, I’m an Avast user and not an Avast Team member.
Plus you didn’t post why the alert came - so I visited - this is the ALERT I got URL Malvertising, see attached screenshot.

b10172
b10172600×635 31.8 KB

Do you outsource your adverts as that could be the source.
New location to report both a False Positive and or a False Negative (for File or URL)

  • Choose Your Sample Submission Type | Avast
  • You won’t get a direct response but it should be analysed within 48 hours, if found to be false it will be removed.
    So it would appear the virus labs still consider it a source of malvertising.
3

Hey, thank you for responding.

Yes, that is the warning screen message we are getting as well.

No, there is no advertising on the website at all - all banners are linked internally, to internal pages.

We’ve already submitted our website via that link so many times, it was never marked as safe.

What are we doing wrong here?

4

To me it seems a somewhat strange Alert window and I have been using Avast for 21 years.

    • The Upgrade Your protection seems somewhat strange, unlike a normal Alert window on a website, I haven’t seen this Upgrade Your Protection. How would that prevent the so called Malvertising Alert that is being displayed. So I just triggered the Alert again and then looked at Upgrade Your Protection option
      b10173
      b10173850×567 97.7 KB
    • I see nothing in there that would actually stop this alert. Short of the one I have highlighted - but to my mind the Web Guard is already doing that.
  • Trying to reload that page again results in a Firefox error as the Web Guard is blocking that until I exit the page.
  • Firefox can’t verify the site’s security certificate,
  • or Something on your computer or network is blocking or replacing the secure connection,
  • or The problem is with the website.

None of which is very satisfactory.

As an Avast user I’m limited in what I can do, but I will try to draw attention to this topic.

5

I have posted in another area of the forum with a link back here - hopefully the virus labs team will be notified and investigate.

I have however also checked out at Virus total and there are now 4 hits out of 98.

You will notice Avast isn’t on this list as the Web Guard only runs on live user connections and not on-demand as being don on the VT checks.

6

Thank you David for all your effort and for checking this for us.

The thing is I was also thinking SSL could be the problem so I checked with host who RE-ISSUED the new SSL certificate and nothing happened.

Then I changed DNS to cloudflare to use their SSL and same thing - no change at all.

This website has no ads at all, no banners, no scripts etc… I have no idea what else to do.

7

You’re welcome, hopefully it will bear fruit.

8

Hello @mail29

Thank you for raising this!

The reported URL was manually checked and based on the findings the detection was removed. The website is now marked as clean in the Avast virus database. This change may take up to 1 hour to take full effect. Please accept my apology for the inconvenience caused.

If the detection persists after 1 hour, please update the Avast virus database and try again.

Thank you.

@DavidR Thank you for investigation, it helped!

1 Like
9

I have since visited the site and confirm that it is no longer detected.

b10174
b10174592×334 70.2 KB

10

Hello,

Thank you so much for solving this for us… it has been too long that we were detected and reported as malicious…

There are tons of people having same/similar problems out there, maybe Avast could create some sort of better system for reporting and checking these things since we are now left to beg for help here on forums and hope someone like you and David will notice us.

Once again thanks to you both we are now finally live again.

Cheers

2 Likes
11

Hello @mail29,

Thank you for your feedback. I understand that the submission flow could be improved, and I’m sorry for the struggle.

For the time being, it is possible to contact our support, and the team will do the best to sort this out.

Thank you again!