False positive with Dropbox

General Topics
1

this js is blocked by avast and giving false positive:
http://dl.dropbox.com/static/javascript/external/dropbox-min.js

2

Hi fr33soul, welcome to the forum :slight_smile:

Interesting, seems that the /external/ location is being blocked…

I would suggest submitting a false positive:
http://www.avast.com/contact-form.php?loadStyles

Scott

3

thx for the reply, i did it!

just to let they know it’s a grave issue…

4

There are domain issues here: http://www.phishtank.com/phish_detail.php?phish_id=1390055
Verified Phish, that is why the site is still blacklisted according to Sucuri:
htxp://dl.dropbox.com/static/javascript/external/dropbox-min.js
status: Site blacklisted, malware not identified
web trust: Site blacklisted.
The malware there, mainly trojans and unknown google malware, has been closed or is dead,

polonus

5

Well only one hit on VT link scan, ParetoLogic (never heard of it) https://www.virustotal.com/url/8d1f1d8511fec3dee45fabbfd1e1c69fee2bee63ada9541b9af83194a5ed5e49/analysis/1333724529/.

Also sucuri also shows it as blacklisted, possibly from the same source polonus shows.

EDIT: I have dropbox and I have added a new file on my desktop for upload and synchronisation, that showed up on my netbook without a problem or alert. I have also accessed my dropbox account and checked my folders, etc. and again no alert.

I found another report from urlviod, from two weeks ago (for whatever reason I can’t get it to rescan the site) and that has a few hits, http://www.urlvoid.com/scan/dl.dropbox.com/.

6

Hi DavidR,

I would hesitate to give the ParetoLogic link, items on that link are more often than not based on old blacklistings or “daily dirt”, where the malware either have been closed, blocked. So a lot of “water under the bridge” out there, so to say. The phish is valid and this is supported by Phishtank, so that could be out there. As I checked the malware list for that particular malware site, all was closed or not responsive for that URL. See: htxp://malc0de.com/database/index.php?search=dl.dropbox.com but these reports are all for “some point in time”, and malware is known to be closed or no longer respond from there soon. But anyhow the site contents should be handled with care. That goes without saying, no guarantees given there, so put your trust in the avast shields!

polonus

7

My main point in all of this was that the normal use of dropbox for me didn’t result in any avast Network shield alert, which is a but strange URL:MAL rather than an alert by the web shield. Plus my visiting my dropbox account didn’t result in a network shield alert.

8

But what the OP wanted us to look into cannot be found any longer there. when trying to visit that URL (without any alerts whatsoever) I get

Error (4xx) We can't find the page you're looking for. Check out our Help Center and forums for help, or head back to home.

So “dropbox” is soon to tackle abuse,

polonus

9

I would be slightly wary of web scanner results. The dl.dropbox domain is the public download section. All public links are part of this domain, so there are probably various things associated with it…

That said, I’ve not encountered this static/javascript area before, and I only use dropbox via the web.

10

Hello,
this doesn’t happen to me. What’s the resolved IP address for this URL?

Edit: It will be fixed in next VPS update.

Milos