False positive?

Viruses and worms
1

When I woke up this morning I had 10 flags on my Mac (10.7.5) which said:

Infection blocked! Avast Web shield has blocked a threat. Infection: URL:Mal URL: http://s2.symcb.com Process: /usr/sbin/ocspd
symbc is a Symantec site.

The following is from seclists.org (http://seclists.org/snort/2014/q4/162)

Two new rules seem to be generating false positives, and indeed I think they are flagging something non malicious in the first place. The signature IDs are 32174 and 32173, which are flagging DNS requests for sr & s2.symcd.com as known malware domains.

Whois for symcd.com gives:

Registrant Name: Domain Manager
Registrant Organization: Symantec Corporation


Is this an issue, or is this a false positive? If it is an issue what should I be doing?

2

similar posts in Mac forum section https://forum.avast.com/index.php?topic=165085.0

3

This is a windows forum.
The mac forum is here:
https://forum.avast.com/index.php?board=5.0

Possible false positives can be reported to the virus lab:
https://www.avast.com/contacts

4

This detection was already fixed todays morning

5

Again. No it is not. This is a “viruses and worms” forum. Any malware may (shall) be discussed here.

6

Hi I also had this happen multiple times yesterday. So it is after all a false positive? It happened when I went to twitter over and over, and then again when I tried to do software update for java from within Avast itself. It also kept giving the url as http: //s2[dot]symcb[dot]com

7

Yes.