Solved: Avira warning about post on TSG

[Davec]

Just had this come up:

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: http://forums.techguy.org/general-security/754255-what-s-best-antivirus-firewall.html
Information: Contains HEUR/HTML.Malware suspicious code

Generated by AntiVir WebGuard 8.0.15.0, AVE 8.1.1.35, VDF 7.0.6.241

 

[~Candy~]

I clicked on it. I have AVG. Nothing popped up

 

[Davec]

It only happened on that one post. I just tried it again from the forum page and didn't get the warning but I do get it if I click the link in my previous post that was copied from the page I got on my earlier attempt.

 

[RootbeaR]

Just had this come up:

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL: http://forums.techguy.org/general-security/754255-what-s-best-antivirus-firewall.html
Information: Contains HEUR/HTML.Malware suspicious code

Generated by AntiVir WebGuard 8.0.15.0, AVE 8.1.1.35, VDF 7.0.6.241

Maybe it is because it says malware so much on that page.

 

[mrss]

One of the replies in that thread had faked up links like
http://www.google.com

where it really wasn't google.com inside the url.

So maybe your browser checks for that as a heuristic test? It would fail this post too then.

 

[Cookiegal]

Your heuristics are probably set too high. On the Antivir website this happened recently with MajorGeeks so they are false positives. If you want to leave your heuristics set high you can tell it to ignore specific sites.

 

[Davec]

Your heuristics are probably set too high. On the Antivir website this happened recently with MajorGeeks so they are false positives. If you want to leave your heuristics set high you can tell it to ignore specific sites.

I'll double check when I get back to that machine in the morning, but I'm 95% sure they're still at the default of medium.

 

[Cookiegal]

I deleted a post in that thread that had a hidden link labeled "Avast" that actually went to another site which is questionable so that may be what it picked up on.

Could you try clicking on the link that gave you that alert again and see whether it repeats or not?

 

[Davec]

I deleted a post in that thread that had a hidden link labeled "Avast" that actually went to another site which is questionable so that may be what it picked up on.

Could you try clicking on the link that gave you that alert again and see whether it repeats or not?

I'm home at the moment and I don't have the premium version with "Web Guard" here so it'll have to be in the morning.

 

[Cookiegal]

OK, thanks.

 

[Davec]

Same results as my post 3 above.

 

[Cookiegal]

Then it must be too agressive heuristics.

 

[Davec]

I did check that, it's on medium.

 

[Cookiegal]

Then medium is still too agressive in some cases.

 

[Davec]

Frankly, on a work machine I prefer to err on the side of caution.