False Malware alert for Avast/AVG users resolved [khj edit]

[Cephus]

It just started showing up and it's near constant. It's a suspicious script-inf on virtually every page here.

Someone might want to look into it. This is the only site where I'm having a problem so it's not me.

Update from khj: It has been confirmed there is no Malware. It is a false positive for users of Avast/AVG software, and they should be correcting the problem as Avast/AVG updates your virus profiles.

[khj]

Thanks for the heads up.

I don't see anything other than the normal ad-trackers that my Malwarebytes is blocking, but otherwise I don't see any identifiable malicious trojans.

For some ad-blockers or anti-virus software that blocks ad-tracking, ProBoards (our host) started using alternative scripts/ad-redirects such as vgi-xxxxxx. Perhaps that is what your anti-malware software is flagging. I, and a small number of other members here and at other ProBoards forums ran into this problem.

The "script-inf" terminology is typically used by Avast/AVG software. I suspect it might either be a false positive, an ID of one of the typical ad-trackers on ProBoards, or you might have a trojan on your computer that is trying to redirect Stamp Bears links.

If you are employing an ad-blocker, temporarily turn it off and see if what I assume is your Avast/AVG stops flagging -- if so, then it's flagging the ad-blocking redirect script.

If you still get the warning flags, I would probably use a free trojan search software to check your computer to specifically identify the trojan. Be forewarned, a lot of those websites offering trojan removal are questionable. You should only use the major brand name trojan removal software to actually remove.

So far, I haven't seen/heard any problems with ProBoards.

[khj]

If anyone else is encountering a similar problem, please don't hesitate to let us know.

Meanwhile, I think I have another computer somewhere that still has Avast/AVG installed. Let me see if I can dig it out after the weekend and see how it responds to Stamp Bears.

[stampie78]

Same here I am getting the same warning. I get on every page "infected with "HTML: script-inf [susp]" and "url;phishing"
I rebooted and nothing changed. Sometimes I can't even open the site at all. Also bottom part of shoutbox is missing lase entry is Apr30. Earlier today I tried to post something there and got nowhere. Checked all my other sites and OK so it must be just stampbears.net that has this problem.

[FairyFoot]

I'm getting it on my forum and even the proboards support forum as well. They are looking into it. Avast/AVG flagging various forums hosted by proboards.


support.proboards.com/thread/670569/virus-malware-threat-warnings

[Cephus]

Same here. On some pages, I just get a blank page (and the warning). So far, I've been just closing the warnings and it mostly works just fine, but this is the second day that it's been happening and it's not going away. It is the only place that is having the problem, including other ProBoards forums.

[khj]

Just to update on this, they are investigating, but their preliminary view is similar to mine -- false positive. or as in my post, I suspect that Avast/AVG is IDing an ad re-direct script as a trojan.

[khj]

My suggestion remains the same. Disable any adblockers you might have. Reboot, and see if your Avast/AVG is still giving you the warning. If you are not getting the warning, that suggests that Avast/AVG is giving you a false positive on an ad redirect script. The Avast/AVG forums are full of threads regarding real and false positives.

Also, be aware that Script-inf is not the name of a virus, but simply the term that Avast/AVG uses to denote a suspicious script. What do they consider to be a suspicious script? It's a either a script that has the signatures of a trojan/harvestor, or a script that is collecting information but they can't figure out what for and triggers a redirect. Hence, why I mentioned that the ad-redirect script may be causing the warning. The redirect is only triggered when you have an adblocker. That is why I suggested you turn off your adblocker, reboot, and see if you still get the warning message.

Depending on how you set up Avast/AVG, it might start blocking webpages flagged as Script-inf after a set number of accesses as a precaution. Hence, you will find sections or even much/all of the webpage blank. Again, Script-inf is not the name of a specific trojan. It is merely one of the generic names that Avast/AVG uses to denote a type of suspicious script.

I actually have Malwarebytes unintentionally installed and operating on this laptop. It's pretty picky, but nothing it has flagged in the log is actually toxic.

I would suggest we wait to see what ProBoards finds on Monday. I can assure you, if there is a problem, it is not a StampBears problem but a ProBoards problem (they are host and also provide the pre-packaged coding).

That being said. We had Avast/AVG on one of our office computers (one of our coworkers is a professional computer tech). Those guys love it for a few good reasons. But they also recognize that it is deeply flawed. And for the average user, it can cause more problems than it helps. After much complaints about the problems being caused by Avast/AVG (especially the freeware versions) on that computer, he removed it. None of our office computers have ever been infected by either a virus nor a trojan.

[khj]

Please note, my replies are regarding the generic warning of Script-inf when using Avast/AVG. If you are getting additional information such as a specific file/script/infection warning (e.g., cmp.js), then the warning should be taken very seriously and user should not proceed to enter into that website.

[Cephus]

If it means anything, I came to see if the problem persisted and it didn't immediately pop up. That's with absolutely no changes on my end.

[stampie78]

May 9, 2022 11:29:56 GMT -5 Cephus said:

If it means anything, I came to see if the problem persisted and it didn't immediately pop up. That's with absolutely no changes on my end.

Same here. It co-operated with me this morning and is still god up to this point. all the things that were missing are now back to normal.

[khj]

Just to update everyone, ProBoards reports that it has been confirmed that Avast/AVG was giving out a false positive. Avast/AVG users should slowly see the problem go away as Avast/AVG updates your software to correct their misID.

There was nothing wrong with ProBoards (other than my irritation that they use vgilink ad redirect script).

If you are still experiencing problems, you can either contact ProBoards support directly, Avast/AVG directly, or switch to another protection software.

[I.M. DeBear]

I didn't see any of it. This convo got me wondering if my security might need some tweaking, but I'm pretty sure I don't have that Avast, so that's good, right?

[khj]

It depends on what you need from anti-virus software, Avast/AVG may or may not be suitable for you. One of our computer tech likes to install Avast. However, I have banished it from our office computers. But don't get me wrong, the developers at Avast are very competent. There are certain things about their product that make it unusable for you are doing conferencing/streaming, one of which cropped up for some Stamp Bears over the weekend. If I had something like that happen during or before a meeting, I'm stuck with no recourse other than to disable my anti-virus software -- which I definitely do not want to do. What I use on my laptops and install at the office is more than suitable for our usage -- anything beyond that or more aggressive than that tends to create far more problems than it prevents.

I do keep a licensed copy of Avast, and still have it installed on some laptop somewhere for reference/testing purposes. But I didn't go dig it out because the characteristics of the errors over the weekend overwhelmingly pointed toward false positive.

Lest you think I am anti-Avast (even though I am), I also no longer use Norton nor McAfee after using them for decades. The main reason is because they no longer offer competitive free rebates (cheapskate's criteria), but there were other reasons as well.

For general users or if you aren't sure if you have a commercial anti-virus software installed, just make sure you have your Windows Firewall up and running all the time (default settings are more than sufficient) and have Windows Security set to automatically update virus definitions. I tend to run my scans manually, because Windows always picks the wrong time to run a scan. If you have something else installed, Windows will tell you if you try to turn on Windows Security.

[I.M. DeBear]

All good, then. My Tech mage has been designing mainframe security packages for 40+ years, and I run a clone of her personally custom-crafted setup. She mentioned Linux grafted onto something-or-other, and 3 firewalls, so I always figured it was plenty good enough for my needs, and it has been for years. You never know, though. As I recall, the first rule in comm-sec was always 'if you can make it, I can break it'

[khj]

3 firewalls is plenty -- assuming you don't accidentally grant access through your firewall. The greatest weakness in any firewall (or gated security fence) is human error in letting/waving someone/something through.

That is why you should never never never immediately directly click on a link in your email or any links in an attached file, even if it is from someone you know (unless you are already expecting it). It's pretty easy to forge the link to either head somewhere else or disguise it to OK a malicious script to run. Instead, hover over the link the URL should appear somewhere (typically at the bottom) of your browser or email server. If it is correct, then either click on it or (my preference) copy/right-click the link and paste it into your browser or email server as a final verification the URL/address is correct/legit.

[I.M. DeBear]

Right-o, rigorous comsec procedures are never going to be optional. Even the best locks don't work if you open the door and invite the vampire in. I don't store anything on my DigitalGoddess, which makes the monthly factory-restore a snap. Just in case