Avast blocking malicious URL

poppie123

Hi all,

I don't know if anyone else has come across this problem today who uses Avast but i keep pop ups blocking a malicious URL.

hxxps://d1ros97qkrwjf5.cloudfront.net/42/eum/rum.js


It has happened on a few websites i have been on including one for a jewellery company that i have used lots and never had a problem before.(all the w's acotisjewellery.co.uk)also happens when i go on the Daily Mail website

Just wondered if it is just me?
.

bod1467

I visited that jewellery site and got no issues. (I am using Avast). This suggests it is you. What if you try a different browser? (Which browser do you normally use?)

poppie123

Nope still happens if i switch to IE (i am using chrome)

Just looked at the Avast forums and seems to be happening to others to so i am not alone.
Just got my OH to try the Daily Mail website on his laptop (he also uses Avast) and it is fine.

Very Strange.

johnnyboyrebel

Well firstly, it is a Javascript link, not a web address which means it is a script that is trying to load. Looking at the code of the page it looks like a simple tracking/cookie/useage type script which, if allowed to run, would not even be visible and you would be unaware it was even there. It is a google script so could relate to analytics. All in all it is a false positive ie. Avast thinks it is malicious but nothing to worry about.

You can open the link, it is not a site, you will simply see a load of gobbledygook which is normal for a script like this.

poppie123

johnnyboyrebel wrote: »

Well firstly, it is a Javascript link, not a web address which means it is a script that is trying to load. Looking at the code of the page it looks like a simple tracking/cookie/useage type script which, if allowed to run, would not even be visible and you would be unaware it was even there. It is a google script so could relate to analytics. All in all it is a false positive ie. Avast thinks it is malicious but nothing to worry about.

You can open the link, it is not a site, you will simply see a load of gobbledygook which is normal for a script like this.

Thanks so much for this, at least now i know its nothing to worry about.
I wonder why though i get it if i try and visit the Daily Mail website but OH on his laptop who also uses chrome and avast does not.

Weird! but good to know it's all ok.

Tinned

Yes my Avast just did the same to me on the Daily Mail site. I googled it and it seems there is a problem as other people saying the same so hopefully its an Avast issue with the software.

waddler_8

Avast isn't detecting the actual file, so it's possibly the domain only it has a problem with?

https://www.virustotal.com/file/94e576bcad0e92487ff7aa20bca6f477f14c8dba7d0169b0277d8d8057292ec2/analysis/1357248415/

http://www.google.com/safebrowsing/diagnostic?site=cloudfront.net

waddler_8

It probably is based on the domain. AVG reports caution as "potentially active threats were detected on a subdomain"

http://www.avgthreatlabs.com/sitereports/domain/cloudfront.net/

poppie123

waddler_8 wrote: »

Avast isn't detecting the actual file, so it's possibly the domain only it has a problem with?

https://www.virustotal.com/file/94e576bcad0e92487ff7aa20bca6f477f14c8dba7d0169b0277d8d8057292ec2/analysis/1357248415/

http://www.google.com/safebrowsing/diagnostic?site=cloudfront.net

Sorry, i am not very computer savvy so i have no idea what that means :embarasse

OH just said it looks like a false positive as jonnyboyrebel said earlier, no idea what it means though :rotfl:

Is it safe to just ignore it then?

waddler_8

It's probably safe to ignore it based on the VirusTotal findings. If those show Avast (nor any other Antivirus) as not detecting the file itself, then it must be the domain it has a problem with.

Google safe browsing & AVG threat labs report bad content having been on (a sub-domain of) cloudfront.net recently.

Avast is probably being a bit over zealous on this occasion. Always best to check first though.

poppie123

waddler_8 wrote: »

It's probably safe to ignore it based on the VirusTotal findings. If those show Avast (nor any other Antivirus) as not detecting the file itself, then it must be the domain it has a problem with.

Google safe browsing & AVG threat labs report bad content having been on (a sub-domain of) cloudfront.net recently.

Avast is probably being a bit over zealous on this occasion. Always best to check first though.

Thanks I'll carry on as usual then and just ignore it.