Is this a fake Avast update or download?

Viruses and worms
1

Hello guys, I just turned on my computer and got an error message from Avast. It said I needed to select fix now or restart the program. After selecting fix now Avast repaired itself and then I got this pop up message.
I just want to know if it is real problem or a false positive.
Here is the url in question (in case the pic does not load) http://download117.avast.com/iavs5x/prod…
Thanks, Nissnut

2

I am having the same problem. This warning keeps popping up.

JR

3

Hmmmm…mysterious. ::slight_smile:

Anyway, entering tatt URL…with my iPad i get 404 not found

Urlquery - suspicious
http://urlquery.net/report.php?id=22897

4

Hence “…” there is more than just /prod

Example: -http://download714.avast.com/iavs4x/servers.def

5

Had same before, now it’s ok and avast updated.

6

I was having similar problems… 1st time auto update failed, 2nd time the virus warning popped up.
It seems fine now though.

7

It will always be suspicious if it can’t connect. :stuck_out_tongue:

8

Hi all
I’m experiencing the same issue here (randomly)

see, please: http://www.avast.com/en-us/lp-security-information-fp2?p_ext=0&utm_campaign=Virus_alert&utm_source=prg_fav_60_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Fit-it%2Fvirus-alert-challenger2&p_vir=al&p_prc=file://C:\Program%20Files\AVAST%20Software\Avast\setup\avast.setup&p_obj=http://download117.avast.com/iavs5x/servers.def.vpx&p_var=.%2Ffa%2Fit-it%2Fvirus-alert-default2&p_pro=0&p_vep=6&p_ves=0&p_lqa=0&p_lsu=24&p_lst=0&p_lex=292&p_lng=en&p_lid=it-it&p_elm=7&p_vbd=1367

Vista SP2 x86 Avast ! Antivirus v 6.0.1367 free - VPS 120218-1 + Online Armor premium 5.5 + MalwareBytes’ Antimalware Pro( Set not to start when Windows starts)+ Sandboxie 3.64 + Firefox 10.02

I attempted to put hXXtp://download117.avast.com into the Webprotection exclusion list with no scuccess since Avast Network shields cannot be customized

Any idea?

Thank you in advance

9

VirusTotal (0/19)
https://www.virustotal.com/url/55d16170c9879f6dbff8851735bac6e5d3bf61308584a3c4549eb91aae546791/analysis/1329599533/

VirusTotal (0/43)
https://www.virustotal.com/file/7ce80514a4260fe18d9db841ac2dc0fc56e5ee39b05905dcb323608ed1b9e468/analysis/1329599380/

10

I am having the same problem and error message appears only if Avast tries to download updates from server download17.avast.com. Other servers - download 116, downlod 787, etc doesn’t show any problems.

Is download17.avast com infected?

11

avast! marked download177.avast.com as Url:Mal for some reason. We’ll have to wait until they confirm that this is false positive or a real threat.

12

I think it is a false positive detection, Avast detects one of its definition updates download directories
see: http://sitecheck.sucuri.net/results/http://download117.avast.com

13

From what I can tell (via a quick check of the servers.def list), download.177.avast.com is the only one being alerted on.

Definitely odd.

Report it here, if you haven’t already.

http://www.avast.com/contact-form.php?loadStyles

14

http://dl.dropbox.com/u/589618/ZScreen/2012-02/Screenshot-2012-02-18_17.28.41.png

I got the same problem earlier today. It’s either a) Avast is so good it blocks itself or b) Avast had a “derp” moment. Lol.

Anyway, I hope it fixes itself.

15

I got this today and called them since the forum was not accessible and I was concerned that Avast had been compromised in its own server or something using its own internet connection.

He did a remote look on my computer and insisted it is not Avast but some problem from faulty Windows or some remnant of some other, incompatible program like a registry key left from a long uninstalled Norton that came with the computer. He said it would be fixed if I paid a windows service tech every couple months to service the computer. So after 15 or a while minutes that is what he kept saying caused this, or using ccleaner, various things like that so that Avast could not function properly because of a faulty Windows or something from a 3rd party software and thus gave the message others have reported here.

I am not convinced this is the correct cause, but it is what was told to me by the Avast rep on the phone.

16

Hmm… I doubt that’s the case since Avast Internet Security was the only Anti-virus program that I’ve ever installed on my new laptop, other than Malwarebytes Pro.

I don’t know much about computer but this sounds like a faulty server on their part, maybe it couldn’t connect that’s why it was blocked? Nevertheless, it’s weird that it’s all coming from download117.

17

http://img407.imageshack.us/img407/2650/avastwarning.jpg

Last blocked connection: http://download117.avast.com/iavs5x/prod-ais.vpx

The link its blocking above seems to be its own update website, so it sounds like its either a bug within the program itself thatll be fixed in future, or a database/server problem. Even if their own systems holding the update data WERE infected (highly unlikely) …remind yourself of one thing-AVAST notified you, and blocked it anyway! :slight_smile: so you are safe. A temporary bug or not, it doesnt make you 100% confident about how reliable the program is in general regarding blocking suspect webpages or web data that could well be completely safe. I like avast, its detection rate is good, and I have no issues when using it with other software, so heres hoping its fixed soon. Who knows, perhaps its a minor problem and something on their own site is causing a false positive reaction

18

just for feedback i got this message too and i know another people who got it too …

edit: btw is just server down http://www.downforeveryoneorjustme.com/http://download117.avast.com/

19

Im hoping theyll be a notification of some sort within the next 12 hrs (if there hasnt been already) acknowledging the problem, as theres bound to be a few over worried users out there reacting to this

What I dont like about avast … is that it tells me that it “blocked me” from visiting the suspect link, yet…
it has a fairly large dark red warning box in the top right actually stating “Infection details”…
which will suggest to many customers that they already have the infection, when the truth is that the program is merely telling them that it has not let them visit the site, so they are completely safe. Perhaps a less harsh red box and change of wording to make things clearer might help lessen the over worry from some users 8)

20

But what about me? I never got this message and I even tried manually updating a few minutes ago just to see. Why do some people not suffer of this?