Unity Player update website is blocked? Why?

Viruses and worms
1

I can go to their website to do update of unity player. But when I play a game, I am required to do update again and it is automatically done, that is connecting to their site.
The automatic connect is blacklisted, I think this is a flase positive

block detail (also shown in picture attached): http://www.avast.com/lp-fr-virus-alert?p_ext=&utm_campaign=Virus_alert&utm_source=prg_fav_90_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Fen-ww%2Fvirus-alert-default&p_vir=URL:Mal&p_prc=C:\Program%20Files\Mozilla%20Firefox\firefox.exe&p_obj=h_218_189_123_38__videoplayer__UnityPlayer3_x_x-win32_zip?ich_u_r_i=c59ca62e48b71c5c37b42df2ebd77fa9&ich_s_t_a_r_t=0&ich_e_n_d=0&ich_k_e_y=1445048921751663222400&ich_t_y_p_e=1&ich_d_i_s_k_i_d=3&ich_s_e_q=110083891&ich_u_n_i_t=1&p_var=.%2Ffa%2Fen-ww%2Fvirus-alert-default&p_elm=7&p_lex=42&p_lid=en-ww&p_lng=tw&p_lqa=0&p_lqe=0&p_lst=0&p_lsu=24&p_pro=0&p_bld=empty&p_vep=9&p_ves=0&p_vbd=2016&p_hid=c568b8ec-42d9-479a-a715-f06ab0c823ec&p_ram=3549&p_cpu=6.5

2

You can report a possible FP here: http://www.avast.com/contact-form.php

3

What is the full URL?

4

The full url is
http://218.189.123.38/videoplayer/UnityPlayer3.x.x-win32.zip?ich_u_r_i=c59ca62e48b71c5c37b42df2ebd77fa9&ich_s_t_a_r_t=0&ich_e_n_d=0&ich_k_e_y=1445048921751663222400&ich_t_y_p_e=1&ich_d_i_s_k_i_d=3&ich_s_e_q=110083891&ich_u_n_i_t=1

edit:
I don’t know what happened, but I try another game, it nearly loaded, but I accidientally close it and trigger the block. Then I retry and it block consistently. This second url is:
http://218.189.123.38/videoplayer/Mono3.x.x-win32.zip?ich_u_r_i=291582044bbedf4c597a8406e55b4e25&ich_s_t_a_r_t=0&ich_e_n_d=0&ich_k_e_y=1445048921751663442418&ich_t_y_p_e=1&ich_d_i_s_k_i_d=7&ich_s_e_q=110154009&ich_u_n_i_t=1

5

Thank you, I will see if I can find anything and report back :slight_smile:

6

My guess is because it I believe goes to a very bad site. Infected with Redkit Java Exploit.

http://urlquery.net/report.php?id=1397788876140

Same IP/ASN/Domain.

URL:Mal means IP or URL blacklist. My guess is it got blacklisted because of that site.

7

Another link that is blacklisted:
http://218.189.123.38/videoplayer/WebPlayer.unity3d?ich_u_r_i=668b58239b5fed0cd012647540a72a45&ich_s_t_a_r_t=0&ich_e_n_d=0&ich_k_e_y=1445048922750363152415&ich_t_y_p_e=1&ich_d_i_s_k_i_d=6&ich_s_e_q=111726983&ich_u_n_i_t=1

I don’t know, but look like this IP is used for downloading files??? It seem that all automatic download is blocked by avast.

8

wYes, because of the Redkit exploit posted in my previous post.

9

Is there any chance this get unblocked? Today, I have reported nearly 30 of these links as flase positive ???. This is mainly from games in a site called 7k7k ( e.g. hp://www.7k7k.com/swf/101737.htm ) it was trying to download game file or new version of unity3d player from this site: hp://wp-china.unity3d.com//autodownload_webplugin-3.x/UnityPlayer2.x.x-win32.zip. I would like to say that the block sometime cause a crash in the existing version of unity3d in my system and usually freeze firefox.

10

Hello,
the IP will be unblocked in next stream update.

Milos