Threat Report [Antivirus-Archive]

Post by **annise** » November 23rd, 2022, 10:19 pm

Thanks, both - I can't see anything the images have in common like all made by 1 person or on the same server etc. I've run out of things I can check at the moment.
Does it happen with their pdfs?

Anne

TheBanjo · Post by **TheBanjo** » November 23rd, 2022, 10:46 pm

annise wrote: ↑November 23rd, 2022, 10:19 pm Does it happen with their pdfs?

Anne

It does with the three works I've listed. Checked one minute ago.

It appears to me to be a server level issue, and quite unrelated to any specific file type. If I click any of the three Internet Archiver server addresses I listed in my posting, I get the block message immediately with "Threat name: URL blacklist". It seems pretty clear to me that the Avast Security product "believes" that anything being served from the servers in question could be suspect. And yet when I check these IA servers against sites that purport to give blacklisting reports, they come up clean. That's particularly maddening!

Example blacklist checking site: https://sitechecker.pro/blacklist-checker/

TheBanjo · Post by **TheBanjo** » November 23rd, 2022, 10:58 pm

Just discovered this location for reporting false positives to Avast. Think I might give this a go.

https://www.avast.com/false-positive-file-form.php#mac

Edit: Just submitted the three AI servers I listed previously for this topic. The form is very quick and easy to fill out. Will keep you posted on developments (if any).

Post by **annise** » November 24th, 2022, 3:03 am

Good idea

Anne

TheBanjo · Post by **TheBanjo** » November 29th, 2022, 4:26 am

TheBanjo wrote: ↑November 23rd, 2022, 10:58 pm Just discovered this location for reporting false positives to Avast. Think I might give this a go.

https://www.avast.com/false-positive-file-form.php#mac

Edit: Just submitted the three AI servers I listed previously for this topic. The form is very quick and easy to fill out. Will keep you posted on developments (if any).

Have now received the following reply from Avast, after I submitted three reports of false positives, one for each of the servers I have listed in this thread:

Hello,

Thank you for reporting this false positive.

We have now cleared its reputation in our database based on the findings and removed the detection. This change may take up to 24 hours to take full effect. Please accept our apology for the inconvenience caused.

If the detection persists after 24 hours, update the virus database in Avast anti-virus and reply to this email with the attached files:
1.Take a screenshot of the Avast detection dialog (Threat Secured pop-up with See details - displayed at the bottom).
2.Take a screenshot of the Avast virus database (open Avast antivirus and go to Menu > About).
We hope you have a nice day and stay safe online.

[Name supplied]
Avast Malware Analysis Team
Enterprise Office Center, Pikrtova 1737/1a, 140 00, Prague 4, Czech Republic

Note that I filed three false positive reports, and this email reply from Avast mentions only one report.
Nonetheless, this response hopefully points to a possible way of resolving the problem reported in this thread: in each case, identify the underlying IA server where Avast is reporting a blacklisting, and then complete the false positive form I have cited above.

As of 10 minutes ago, all three sites I cited are still showing up as blacklisted by Avast. I'll check again in 24 hours. If Avast Support are as good as their word, the problem should by then have gone away for at least one of these. And hopefully in coming days Avast will unblock the other two I reported as well.

Peter

Post by **TriciaG** » November 29th, 2022, 5:30 am

Great - thank you for doing that!

TheBanjo · Post by **TheBanjo** » November 29th, 2022, 5:38 am

So, I can confirm that within the last two hours, Avast has ceased the block as "blacklisted" the following IA servers that host Librivox books:

https://ia804507.us.archive.org
https://ia904609.us.archive.org

These blockages have been removed because I reported these servers as "false positives" to Avast using their online form at https://www.avast.com/false-positive-file-form.php#mac

This does NOT mean this problem has yet been entirely solved. Far from it. To solve the problem, we need a list of ALL the IA Servers involved in throwing "blacklisted" errors, and we need to report all of these as false positives to Avast using that "false positives" form.

msfry · Post by **msfry** » November 29th, 2022, 10:02 am

I got a similar report from AVG this morning. I'll check tomorrow and see if the problem is resolved, and let you all know.

Hello,

Thank you for reporting this false positive.

We have now cleared its reputation in our database based on the findings and removed the detection. This change may take up to 24 hours to take full effect. Please accept our apology for the inconvenience caused.

If the detection persists after 24 hours, etc.

AVG Malware Analysis Team