False positive?

Avast Free Antivirus / Premium Security
1

Hi,

I’m running a Joomla site and use the JCE editor for backend editing.

There has been a history for older versions of the JCE component to be attacked by exploit attempts but newer versions should not have that weakness.

Still, Avast blocked that component as a Trojan (Other:Malware-gen [Trj]) today:

…/components/com_jce/editor/tiny_mce/tiny_mce_popup.js?a990757478edca862d0bc4f467dffdb9

and the developer says that Avast is the only one reporting this as an issue.

How should I deal with Avast blocking this url/script?

Thanks,

2

Post VirusTotal link of that file and let see and then post the result here and if it is FP then report it to Avast! :slight_smile:

3

Submitting False Positive
https://www.avast.com/false-positive-file-form.php

4
How should I deal with Avast blocking this[b] url[/b]/script?
Post the URL here
5

This is the Virus Total scan on the day the package was released

https://www.virustotal.com/en/file/469bd62d2962a4619e507f7e792784f8294fb492039205d6b4c3fd78751111db/analysis/1457620372/

and the scan from today

https://www.virustotal.com/en/file/469bd62d2962a4619e507f7e792784f8294fb492039205d6b4c3fd78751111db/analysis/

6

This file - https://github.com/tinymce/tinymce/blob/3.x/jscripts/tiny_mce/tiny_mce_popup.js

and the file in question are identical in content (apart from the comments at the top), but the former does not trigger false positive.

7

Some xxs vulnerable code: Results from scanning URL: -https://assets-cdn.github.com/assets/github-ab1086948a3be528001710080ba17e4975ddb36a9379ab7dddfdb0370647b7c1.js
Number of sources found: 281
Number of sinks found: 103
Consider: -http://www.domxssscanner.com/scan?url=https%3A%2F%2Fgithub.com%2Ftinymce%2Ftinymce%2Fblob%2F3.x%2Fjscripts%2Ftiny_mce%2Ftiny_mce_popup.js
This does not kick-up an Avast alert for me: https://github.com/tinymce/tinymce/blob/3.x/jscripts/tiny_mce/tiny_mce_popup.js

polonus

8

thanks for information, this was a false positive and it will be fixed in next stream update.

9

Thanks all for your input!

Apart from learning about the false positive, I also got some valuable information - at least for a newbie like me :wink: