What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 130 Stack Exchange communities.

I've just followed a link to this SO question from the review page, and been confronted by a Trojan Horse virus warning from Avast. It's suggesting that the page is infected with the " VBS:ExeDropper-gen" trojan.

Is anyone else seeing this? I'm suspecting a dodgy virus definition as I see something similar has apparently happened before.

Disclaimer: I hope it's a false alarm, but you might not want to follow the link if you're unsure of your current AV software's support for this particular trojan.

EDIT: it is indeed a false alarm, and the question is perfectly safe to view (though don't save and execute that script!) The question is this one.

I'm using Chrome 12.0.742.122 under Windows 7, Avast 5.1.864 with definitions 110803-1.

Screen grab:

enter image description here

share|improve this question
Isn't that interesting? It appears that Avast is scanning the text in the posted code, and interpreting as executable script (It's not executable from the SO web page, unless you're silly enough to paste it into a .VBS file and execute it yourself). –  Robert Harvey Aug 3 '11 at 20:29
But note that the error message is pretty explanatory...If you read the URL you can probably figure out what happened. –  Robert Harvey Aug 3 '11 at 20:31
Ah - didn't read the full URL, just followed a link to it. Now can't decide whether Avast is being very clever, or too clever by half. –  razlebe Aug 3 '11 at 20:33
Perhaps worth reporting as a "false positive" to Avast? No idea if this is something that can be "properly" handled. –  Bart Aug 3 '11 at 20:35
I'll do that, and if I get a response I'll come back and post it. –  razlebe Aug 3 '11 at 20:37
The number of SO questions this affects is vanishingly small, so if you have a predilection for such questions, you might want to try a different browser. –  Robert Harvey Aug 3 '11 at 20:39
It's not Chrome that's the problem - it's Avast. If I disable Avast's "web shield", I can view the page. –  razlebe Aug 3 '11 at 20:44
Does Avast have a white list? –  Robert Harvey Aug 3 '11 at 20:51
Yes it does - see answer below. –  razlebe Aug 3 '11 at 23:34
I would change the title to "Some antivirus might report..." as my workplace sonicwall antivirus is blocking access to the question. This is not a specific issue to Avast sadly. –  Jonathan Drapeau May 14 at 15:54

2 Answers 2

up vote 12 down vote accepted

This behavior is not a feature, and it will be fixed in the next virus definition update (probably tonight).

Sorry for any inconvenience.

share|improve this answer
Thanks - you work for Avast? –  razlebe Aug 5 '11 at 8:18
I recently encountered the exact same behavior on another SO question: "Black Hole Exploit" notice from AVG for a web site, and I could only get past it by whitelisting SO. Still seemed to be a problem until I did that. –  Nightfirecat Oct 1 '11 at 17:13
@Nightfirecat This problem (as decribed in the question here) was an issue with Avast's virus definitions. If you're seeing a problem with AVG, then I recommend that you take it up with AVG support –  razlebe Nov 15 '11 at 16:33
This is still happening for me. –  SixfootJames Dec 8 '11 at 9:36

EDIT: Avast have fixed this as promised.
Using virus definitions version 110807-0, I am now able to load the page. I'm leaving my original answer in place here to provide guidance in case this happens again in the future.

Credit to @Robert Harvey and @Bart for helping answer this question with their comments. Collating all of the comments and suggestions:

  • It appears that Avast is scanning the text in the posted code, and interpreting as executable script
  • The script is not executable from the SO web page, unless you're silly enough to paste it into a .VBS file and execute it yourself - so it isn't an actual threat. That being the case, one might conclude that the observed behavior is Avast reacting to a false positive.
  • The number of SO questions likely to trigger this behavior is very small indeed
  • The workaround for this problem is to add the StackOverflow URL to the Exclusions whitelist in Avast's web shield settings (screenshot below). The problem question and others like it will then load normally.

Avast Web Shield Settings

I've raised a support ticket with Avast to determine whether they consider this behavior to be a feature or a defect, and if I get a response I'll update my answer accordingly.

share|improve this answer
great answer, hopefully helpful to future visitors in the same boat too! –  Jeff Atwood Aug 4 '11 at 0:35
I assume they're unable to see the difference between code in a <script> tag and code visible on the page. With a good tag soup, this might be a non-trivial case, and in terms of expediting the virus scan might just look for parts of that long blob that the code dumps to the file. I don't think Avast will bother fixing this to be honest. –  Lasse V. Karlsen Aug 4 '11 at 10:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .