Threat Report [Antivirus-Archive]

Report & help check download problems, corrupted files, badly-named files, bad links etc. (NOT for style & reading complaints)
annise
LibriVox Admin Team
Posts: 36608
Joined: April 3rd, 2008, 3:55 am
Location: Melbourne,Australia

Post by annise » November 23rd, 2022, 10:19 pm

Thanks, both - I can't see anything the images have in common like all made by 1 person or on the same server etc. I've run out of things I can check at the moment.
Does it happen with their pdfs?

Anne

TheBanjo
Posts: 849
Joined: January 23rd, 2021, 8:19 pm
Location: Melbourne, Australia
Contact:

Post by TheBanjo » November 23rd, 2022, 10:46 pm

annise wrote:
November 23rd, 2022, 10:19 pm
Does it happen with their pdfs?

Anne
It does with the three works I've listed. Checked one minute ago.

It appears to me to be a server level issue, and quite unrelated to any specific file type. If I click any of the three Internet Archiver server addresses I listed in my posting, I get the block message immediately with "Threat name: URL blacklist". It seems pretty clear to me that the Avast Security product "believes" that anything being served from the servers in question could be suspect. And yet when I check these IA servers against sites that purport to give blacklisting reports, they come up clean. That's particularly maddening!

Example blacklist checking site: https://sitechecker.pro/blacklist-checker/

TheBanjo
Posts: 849
Joined: January 23rd, 2021, 8:19 pm
Location: Melbourne, Australia
Contact:

Post by TheBanjo » November 23rd, 2022, 10:58 pm

Just discovered this location for reporting false positives to Avast. Think I might give this a go.

https://www.avast.com/false-positive-file-form.php#mac

Edit: Just submitted the three AI servers I listed previously for this topic. The form is very quick and easy to fill out. Will keep you posted on developments (if any).

annise
LibriVox Admin Team
Posts: 36608
Joined: April 3rd, 2008, 3:55 am
Location: Melbourne,Australia

Post by annise » November 24th, 2022, 3:03 am

Good idea :D Anne

TheBanjo
Posts: 849
Joined: January 23rd, 2021, 8:19 pm
Location: Melbourne, Australia
Contact:

Post by TheBanjo » Today, 4:26 am

TheBanjo wrote:
November 23rd, 2022, 10:58 pm
Just discovered this location for reporting false positives to Avast. Think I might give this a go.

https://www.avast.com/false-positive-file-form.php#mac

Edit: Just submitted the three AI servers I listed previously for this topic. The form is very quick and easy to fill out. Will keep you posted on developments (if any).
Have now received the following reply from Avast, after I submitted three reports of false positives, one for each of the servers I have listed in this thread:

Hello,

Thank you for reporting this false positive.

We have now cleared its reputation in our database based on the findings and removed the detection. This change may take up to 24 hours to take full effect. Please accept our apology for the inconvenience caused.

If the detection persists after 24 hours, update the virus database in Avast anti-virus and reply to this email with the attached files:
1.Take a screenshot of the Avast detection dialog (Threat Secured pop-up with See details - displayed at the bottom).
2.Take a screenshot of the Avast virus database (open Avast antivirus and go to Menu > About).
We hope you have a nice day and stay safe online.

[Name supplied]
Avast Malware Analysis Team
Enterprise Office Center, Pikrtova 1737/1a, 140 00, Prague 4, Czech Republic


Note that I filed three false positive reports, and this email reply from Avast mentions only one report.
Nonetheless, this response hopefully points to a possible way of resolving the problem reported in this thread: in each case, identify the underlying IA server where Avast is reporting a blacklisting, and then complete the false positive form I have cited above.

As of 10 minutes ago, all three sites I cited are still showing up as blacklisted by Avast. I'll check again in 24 hours. If Avast Support are as good as their word, the problem should by then have gone away for at least one of these. And hopefully in coming days Avast will unblock the other two I reported as well.

Peter

TriciaG
LibriVox Admin Team
Posts: 56507
Joined: June 15th, 2008, 10:30 pm
Location: Toronto, ON (but Minnesotan to age 32)

Post by TriciaG » Today, 5:30 am

Great - thank you for doing that!
Christmas Short Works Collection 2022: LINK

TheBanjo
Posts: 849
Joined: January 23rd, 2021, 8:19 pm
Location: Melbourne, Australia
Contact:

Post by TheBanjo » Today, 5:38 am

So, I can confirm that within the last two hours, Avast has ceased the block as "blacklisted" the following IA servers that host Librivox books:

https://ia804507.us.archive.org
https://ia904609.us.archive.org

These blockages have been removed because I reported these servers as "false positives" to Avast using their online form at https://www.avast.com/false-positive-file-form.php#mac

This does NOT mean this problem has yet been entirely solved. Far from it. To solve the problem, we need a list of ALL the IA Servers involved in throwing "blacklisted" errors, and we need to report all of these as false positives to Avast using that "false positives" form.

msfry
Posts: 9800
Joined: June 4th, 2013, 9:09 am
Location: Baton Rouge, Louisiana
Contact:

Post by msfry » Today, 10:02 am

I got a similar report from AVG this morning. I'll check tomorrow and see if the problem is resolved, and let you all know.

Hello,

Thank you for reporting this false positive.

We have now cleared its reputation in our database based on the findings and removed the detection. This change may take up to 24 hours to take full effect. Please accept our apology for the inconvenience caused.

If the detection persists after 24 hours, etc.

AVG Malware Analysis Team
Michele Fry, CC
My LV Covers
Collecting stories here:
Coffee Break #34 - VACATIONS 15 minutes or less.

Post Reply