Avast Anti Virus Program Reports VEF As Malware

[nbwriter]

Dear Contributors,

To access what Avast is scanning and blocking in Real Time Mode, just go to:

C:\ProgramData\Avast Software\Avast\Report

You'll find the log file called : Webshield.log

Here's mine when I logged into VEF today:

04/04/2015 16:09:26 http://vintage-erotica-forum.com/|>{gzip} [L] HTML:Script-inf (0)
04/04/2015 16:09:26 http://yui.yahooapis.com/2.9.0/build...event.js?v=387 [L] HTML:Script-inf (0)
04/04/2015 16:09:27 http://vintage-erotica-forum.com/ [L] HTML:Script-inf (0)
04/04/2015 16:09:52 http://pirrains.com/zwh/h--NwVJQU-ml...ae48dbWf6m2b-d [L] URL:Mal (0)

That looks like 4 attempts to access my hard drive and deposit malware on it. Is anyone at VEF looking at this issue pls?

Regards, NB

[MrLinc]

Originally Posted by nbwriter

04/04/2015 16:09:26 http://vintage-erotica-forum.com/|>{gzip} [L] HTML:Script-inf (0)
04/04/2015 16:09:26 http://yui.yahooapis.com/2.9.0/build...event.js?v=387 [L] HTML:Script-inf (0)
04/04/2015 16:09:27 http://vintage-erotica-forum.com/ [L] HTML:Script-inf (0)
04/04/2015 16:09:52 http://pirrains.com/zwh/h--NwVJQU-ml...ae48dbWf6m2b-d [L] URL:Mal (0)

Actually, the only malware is the last one, I'm 99% sure it's stuff that comes with the 3rd party advertisements in the forum.

The others are script libraries the forum software has got built-in, for anything from the quick reply feature to editing a post to... you name it, any of the forum features.

A forum system like this one, vBulletin, relies heavily on that stuff; even more if it's got plug-ins like vbseo or any other. Don't be afraid of that, it's not malware. As I said, beware of advertisements, better install an ad-blocker add-on for your browser.

[nbwriter]

Dear Contributors,

Thanks to MrLinc for feedback

"script libraries" appear to be reported as HTML:Script-inf (a real virus) as far as I know. I haven't been able to establish if this is a false positive or not (maybe i should contact Avast directly for advice?)

yahoo-dom-event.js (looks like a javascript module to me) - VirusTotal reports "yahoo-dom-event.js" as malware (but curiously, not when it originates from:

http://yui.yahooapis.com/ << this appears to be a legitimate site

http://pirrains.com << is reported at VirusTotal as malware by one AV engine. To test any URL, go to:

https://www.virustotal.com/en/ - select URL tab, paste in suspect URL and press Scan it! button.

Since I have adblock running, I can create a "block" for pirrains.com (this site is highly suspect, as it does not function as a normal website).

Kind Regards NB