Hello everyone,
At 5 pm i was on Google and i typed in the search bar the command to delete System32 (Windows XP) in Command Prompt (just for fun).
There was a video on youtube, i clicked on it and avast said this :
[b]Avast Web Shield blocked a threat :
Infection : BV:DelFiles (Trj)
File : {gzip}
Process : /Applications/Google Chrome.app/Contents/MacOS/Google Chrome[/b]
A Youtube page is infected ?? Never saw that since i une youtube (since February 2009)
I am using MacOS.
Can you give us a link to the youtube video? Just make sure its in htxp format to be not clickable
htxp://www.youtube.com/watch?v=O5Q0w03py2A
I made a test and i can watch popular Youtube videos (around 6 million views) normally.
D
Probably because the batch file (crash code) is posted in youtube comments below the movie
Ok, so the famous “delete” command is in the description !
Yes, and avast webshield read all code in the html … and BANG , detection
and as you see from my VT link above, most consider it malicious / dangerous
detection name say it all > Delete / KillAll / KillFiles
But, a question remains : As i know that the code posted in the comments is in MS-DOS (Batch files),so it is Windows language, how could a Mac version of the antivirus be alerted, as MacOS does not use MS-DOS ? :-\
Because they use the same signatures (maybe not all but many). There are also cross platform malware
Anyway you may recive a mail with attached doc on your Mac that containe a windows malware (not knowing) you may spread that malware by forward that mail to users with windows pc, so AV stop the infection as soon as possible. Most AV will detect malicious files for windows / mac / Linux / android
Such cases have been reported before if you use the forum search function you can see how many have seen this happen.
Its just the code in the video description triggering web shield which scans all code and html.This shows how good avast can be at blocking malicious web pages and scripts. 