Antivirus blocking connections

News and comments about this board.
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Antivirus blocking connections

Post by PD2/20 »

I have recently been getting pop-up messages from Avast One antivirus on my PC reporting connections to busaustralia.com being blocked because of a JS:Agent-EIY [Trj] infection. Several different URLs of js files appear in the pop-ups:
https://busaustralia.com/forum/ext/cleantalk/antispam/styles/all/template/cleantalk.js?assets_version=17
https://busaustralia.com/forum/assets/javascript/editor.js?assets_version=17
https://busaustralia.com/forum/assets/javascript/plupload.js?assets_version=17
https://busaustralia.com/forum/assets/plupload/plupload.full.min.js?assets_version=17

I assume that the forum website is running an antivirus to prevent the dissemination of virus infections and so suspect the blocking is a case of false postive detection. Can the board administrators confirm that no viruses have been detected on the website?

I can view the board content on my PC, but the blocking of the J's files is disabling the submission of posts to the forum. I am attempting to post this from an Android device.
Last edited by PD2/20 on Mon Aug 15, 2022 1:45 pm, edited 1 time in total.
User avatar
Fleet Lists
Administrator
Posts: 23803
Joined: Sat Mar 06, 2004 12:49 pm
Location: The Shire

Re: Antivirus blocking connections

Post by Fleet Lists »

I have also encountered this today and have reported this but it has not stopped me from posting.
Living in the Shire.
User avatar
Fleet Lists
Administrator
Posts: 23803
Joined: Sat Mar 06, 2004 12:49 pm
Location: The Shire

Re: Antivirus blocking connections

Post by Fleet Lists »

It has been reported as fixed but the corruption can happen again so let us know if it happens again.
Living in the Shire.
User avatar
boronia
Posts: 21567
Joined: Sat Mar 06, 2004 6:18 am
Favourite Vehicle: Ahrens Fox; GMC PD4107
Location: Sydney NSW

Re: Antivirus blocking connections

Post by boronia »

When I am logged into the board, Norton keeps reporting that it has blocked and removed a JS Cryxos!inf file.
Preserving fire service history
@ The Museum of Fire.
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

Fleet Lists wrote: Wed Jul 13, 2022 5:46 pm It has been reported as fixed but the corruption can happen again so let us know if it happens again.
This morning I am continuing to receive threat blocking messages relating to the cleantalk.js and plupload.full.min.js files.

Yesterday afternoon I submitted the cleantalk.js URL to the Avast False Detection webpage and received last night thefollowing reply:
Hello,

Thank you for contacting Avast and reporting a false positive detection. I'm happy to help.

Along with the Avast virus specialist, we’ve confirmed that this detection is correct.

If you are the owner of the reported file or website and you want to change the detection to clean, feel free to contact us again for a new analysis as soon as it matches the Avast Clean Guidelines.

Thank you for understanding.

I hope you have a nice day, and stay safe online.

Miroslav

Miroslav Hečko
Avast Customer Care Team
The Avast Clean Guidelines contain about 80 different criteria but unfortunately the Avast reply does not indicate which guideline is being violated!
User avatar
boronia
Posts: 21567
Joined: Sat Mar 06, 2004 6:18 am
Favourite Vehicle: Ahrens Fox; GMC PD4107
Location: Sydney NSW

Re: Antivirus blocking connections

Post by boronia »

cryxos.jpg
This is the message I get every couple of minutes while logged into the board.
Norton claims to have removed it, but it keeps coming back.
Preserving fire service history
@ The Museum of Fire.
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

boronia wrote: Thu Jul 14, 2022 5:24 pm cryxos.jpg

This is the message I get every couple of minutes while logged into the board.
Norton claims to have removed it, but it keeps coming back.
Does the origin tab of the message identify the name or URL of the offending file?

Antivirus software offers protection against attacks in several ways. A file present on a file system can be recognised during a scheduled scan after it has arrived on your computer and then quarantined. A file downloaded from the web can be scanned as it arrives and then placed in quarantine. Thirdly, if a virus has already been identified in a file that is held on a web server, the URL of the file can be placed on a blacklist. Any subsequent attempt to obtain the file from the server will be blocked and the file will not be downloaded from the server to your computer. From the Norton message you have posted it is not clear which action Norton has taken.
User avatar
Fleet Lists
Administrator
Posts: 23803
Joined: Sat Mar 06, 2004 12:49 pm
Location: The Shire

Re: Antivirus blocking connections

Post by Fleet Lists »

I have just been advised that another error has been fixed.

Please let us know if it is still occurring.
Living in the Shire.
User avatar
boronia
Posts: 21567
Joined: Sat Mar 06, 2004 6:18 am
Favourite Vehicle: Ahrens Fox; GMC PD4107
Location: Sydney NSW

Re: Antivirus blocking connections

Post by boronia »

Seems to have stopped now. Thank you.
Preserving fire service history
@ The Museum of Fire.
User avatar
boronia
Posts: 21567
Joined: Sat Mar 06, 2004 6:18 am
Favourite Vehicle: Ahrens Fox; GMC PD4107
Location: Sydney NSW

Re: Antivirus blocking connections

Post by boronia »

Has returned again this afternoon.
Preserving fire service history
@ The Museum of Fire.
I Follow PAFC
Posts: 147
Joined: Fri May 30, 2014 5:13 pm
Favourite Vehicle: Any low floor bus

Re: Antivirus blocking connections

Post by I Follow PAFC »

Been getting this the last two days.
Attachments
threat secured.jpg
threat secured.jpg (111.88 KiB) Viewed 3536 times
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

The message that I Follow PAFC posted is almost identical to those that I received and am continuing to receive. It relates to cleantalk.js and occurs when I open or refresh the BA website. Further messages relating to plupload.full.min.js and editor.js appear when I start composing a reply.

I emailed Avast support to follow up on their response to my submission to the false positive form. I received a reply which did not provide any further information on which of the Avast Clean Guidelines was being violated.
I Follow PAFC
Posts: 147
Joined: Fri May 30, 2014 5:13 pm
Favourite Vehicle: Any low floor bus

Re: Antivirus blocking connections

Post by I Follow PAFC »

PD2/20 wrote: Sat Jul 16, 2022 9:36 am The message that I Follow PAFC posted is almost identical to those that I received and am continuing to receive. It relates to cleantalk.js and occurs when I open or refresh the BA website. Further messages relating to plupload.full.min.js and editor.js appear when I start composing a reply.

I emailed Avast support to follow up on their response to my submission to the false positive form. I received a reply which did not provide any further information on which of the Avast Clean Guidelines was being violated.
That message came up with AVG.
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

I Follow PAFC wrote: Sat Jul 16, 2022 11:09 am
PD2/20 wrote: Sat Jul 16, 2022 9:36 am The message that I Follow PAFC posted is almost identical to those that I received and am continuing to receive. It relates to cleantalk.js and occurs when I open or refresh the BA website. Further messages relating to plupload.full.min.js and editor.js appear when I start composing a reply.

I emailed Avast support to follow up on their response to my submission to the false positive form. I received a reply which did not provide any further information on which of the Avast Clean Guidelines was being violated.
That message came up with AVG.
Avast acquired AVG in 2016.
I Follow PAFC
Posts: 147
Joined: Fri May 30, 2014 5:13 pm
Favourite Vehicle: Any low floor bus

Re: Antivirus blocking connections

Post by I Follow PAFC »

PD2/20 wrote: Sat Jul 16, 2022 12:33 pm
I Follow PAFC wrote: Sat Jul 16, 2022 11:09 am

That message came up with AVG.
Avast acquired AVG in 2016.
Thanks for that
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

Fleet Lists wrote: Thu Jul 14, 2022 7:37 pm I have just been advised that another error has been fixed.

Please let us know if it is still occurring.
Avast is still continuing to block the 4 js file URLs that I reported previously. Hoverever I submitted these URLs to the VirusTotal online checker which in turn submits them to over 40 different security providers for checking. No malicious threats were detected in any of the files. So it looks as if this a case of false positive detections by Avast and AVG.

Thank you for your attention to my posts.
User avatar
boronia
Posts: 21567
Joined: Sat Mar 06, 2004 6:18 am
Favourite Vehicle: Ahrens Fox; GMC PD4107
Location: Sydney NSW

Re: Antivirus blocking connections

Post by boronia »

It seems the "suspension" this afternoon has fixed my problem.
Preserving fire service history
@ The Museum of Fire.
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

boronia wrote: Sun Jul 17, 2022 8:45 pm It seems the "suspension" this afternoon has fixed my problem.
Likewise.
I Follow PAFC
Posts: 147
Joined: Fri May 30, 2014 5:13 pm
Favourite Vehicle: Any low floor bus

Re: Antivirus blocking connections

Post by I Follow PAFC »

Had no problems in the last two days.
User avatar
boronia
Posts: 21567
Joined: Sat Mar 06, 2004 6:18 am
Favourite Vehicle: Ahrens Fox; GMC PD4107
Location: Sydney NSW

Re: Antivirus blocking connections

Post by boronia »

boronia wrote: Thu Jul 14, 2022 5:24 pm cryxos.jpg

This is the message I get every couple of minutes while logged into the board.
Norton claims to have removed it, but it keeps coming back.
It has returned today.
Preserving fire service history
@ The Museum of Fire.
User avatar
Fleet Lists
Administrator
Posts: 23803
Joined: Sat Mar 06, 2004 12:49 pm
Location: The Shire

Re: Antivirus blocking connections

Post by Fleet Lists »

I also received a Private Message about this earlier today. Both have been passed on to the technical people.
Living in the Shire.
I Follow PAFC
Posts: 147
Joined: Fri May 30, 2014 5:13 pm
Favourite Vehicle: Any low floor bus

Re: Antivirus blocking connections

Post by I Follow PAFC »

Threat Secured
Attachments
ba.jpg
ba.jpg (65.9 KiB) Viewed 2591 times
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

Fleet Lists wrote: Wed Aug 10, 2022 2:35 pm I also received a Private Message about this earlier today. Both have been passed on to the technical people.
Avast One is continuing to block access to the files I reported previously. In addition it is now complaining about core.js.
User avatar
Fleet Lists
Administrator
Posts: 23803
Joined: Sat Mar 06, 2004 12:49 pm
Location: The Shire

Re: Antivirus blocking connections

Post by Fleet Lists »

I have been advised that hopefully it has now be totally fixed.
Living in the Shire.
PD2/20
Posts: 183
Joined: Tue Sep 03, 2013 11:45 pm

Re: Antivirus blocking connections

Post by PD2/20 »

Fleet Lists wrote: Tue Aug 16, 2022 2:41 pm I have been advised that hopefully it has now be totally fixed.
Since yesterday the blocking has ceased occurring.
Post Reply

Return to “News & Administration”