Spanish Tax Office (AEAT) - Virus

Viruses and worms
1

I have just tried to download a tax form called Modelo 390 from the website of the Spanish tax office (AEAT) and Avast detects the following virus Java:Jade-C. I have contacted the AEAT IT section and they claim it is a false positive and that I should deactivate Avast then download it. Given the track record of Spanish government websites for which one has to add a multitude of security exceptions in order to be able to access them I am reluctant to do this.

The URL is as follows:

hxtp://www.agenciatributaria.es/static_files/AEAT/Contenidos_Comunes/La_Agencia_Tributaria/Descarga_Programas/Descarga/Java/IVA/2015/IVA2015_windows_1_00.exe

Can you please advise

2

Please break that live link as with wXw. See IP badness history: https://www.virustotal.com/nl/ip-address/184.86.240.81/information/
and https://www.threatcrowd.org/ip.php?ip=184.86.240.81
Re: https://www.virustotal.com/nl/file/ed99b5642f4e575d4d1636d7c9aa73d991cc6ccb1e985f268261d4712d59c75f/analysis/1451997491/

polonus

3

Thanks for your reply. I have broken the link as requested, sorry.

Virus Total shows only Avast giving a positive so can I disable Avast and download and use the program as advised by AEAT IT or not? I can’t see the connection with 184.86.240.81

4

You can report a suspected FP here: https://www.avast.com/false-positive-file-form.php

5

Thanks.

6

You’re welcome.

7

F-Prot also detects something :
http://r.virscan.org/report/2267e9041c8cb7b3fa0667a9cd518f59

8

fprot 4.6.2.117 6.5.1.5418 Signature date - 2016-01-02

On VT fprot signature date is 20160105

ahnlab >> 2013-05-28 ::slight_smile: on VT updated

Why i never use virscan, old engines and old signatures

9

Just to confirm,

Message from F-secure lab

Thank you for your submission.
The file you submitted is clean. It is not malicious.

10

Will be fixed in next VPS update.

11

Many thanks to Avast Technical Support for resolving this matter.