13

Virus report warning each time I access a Stack Overflow page:

Screenshot:

Dialog showing A virus or unwanted program was found

Script in question: http://cdn.sstatic.net/js/wmd.js?v=4299f69ea585

Improve this question
52

You may want to take this to your AV Software vendor. This is clearly a false positive on their end.

Edit: Okay, here's what I did. I found some website where you can upload a file, and it'll scan it with twenty different virus scanners. And sure enough, Avira (and only Avira) considers wmd.js (that's the Markdown editor) to contain a virus.

So after deleting stuff from the file here and there, reuploading the changed version, waiting for the scan, checking whether it's still a "virus", readding something or removing something else, rinse and repeat (anywhere between 20 and 50 times; I didn't keep count), I finally found why Avira considers us to be spreading viruses:

We were using the evil black hat hacking tool commonly known as Math.random()!

Two places use a random number in that file:

  1. The workaround from Weird repost of last picture in chat, and
  2. A random amount of time between 0 and 10 seconds that is added to a timeout delay when a request is denied by the server (because of throttling), in case the user has multiple browser pages open that make the same request at regular intervals.

Just removing the random number from 1 is fine, since there's also a "current time" part in the IFRAME id.

I replaced the Math.random() * 10 from 2 by (new Date().getTime()%100)/10;, which is good enough for that use case.

Removing just one of the two still triggered the virus scanner; but removing both stopped it.

This has been deployed, so this stupidity should be over now. Thank you Avira, this was fun. Not.

Improve this answer
  • Might be still in some black list, related to this? – Shadow Wizard is Vaccinating Nov 8 '11 at 11:43
  • Might be related, but this is a false positive of a heuristic, not a simple blacklist lookup (IOW, this very issue may be the reason for the blacklisting, but not the other way around). However, without knowing what exactly triggers the heuristic, we can't even work around this. – balpha Nov 8 '11 at 11:51
  • One might note, that the AV vendor will not tell you the heuristic anyway. – Time Traveling Bobby Nov 8 '11 at 15:29
  • 12
    You were using clearly using it to randomize the bit stream and corrupt the secure processes to give you unlimited access to the mainframe! Also, I believe they did indeed fix the first issue in Chrome a while back, though there's certainly no (more) harm in keeping the workaround. – Tim Stone Nov 8 '11 at 16:52
  • 2
    Nice work on this balpha. I never saw the issue (don't use avira), but this must have been truly tedious. – Joel Coehoorn Nov 8 '11 at 16:56
  • 3
    I'm not sure how reputable it is, but this paper indicates that the Math.random() implementations in various browsers are/were kind of weak and prone to information leakage. It seems absurd that an AV program would classify a script based on that, though. – Tim Stone Nov 8 '11 at 17:12
  • Wouldn't (new Date().getTime()%100)/10; return the same value if requested by multiple tabs at the same time, making it a poor choice for that use case? – Kevin Vermeer Nov 8 '11 at 17:12
  • @Kevin yeah, but that chance is very small (we're talking milliseconds here), and if it's two tabs, only one of them will use it anyway (the one that got throttled). – balpha Nov 8 '11 at 17:19
  • Ah, I read that this was implemented in case the user has multiple browser pages open that make the same request at regular intervals., and assumed that the intervals were synchronized to millisecond levels. Great work, BTW. – Kevin Vermeer Nov 8 '11 at 17:25
  • 3
    Why not go for something like eval(decodeURI('%4d%61%74%68%2e%72%61%6e%64%6f%6d%28%29')) instead of calling Math.random? I bet their techniques of analyzing the code aren't all that sophisticated. This virus scanner must have a huge false positive rate. Math.random is used all over the internet. – Kibbee Nov 8 '11 at 19:36
  • I was so hoping you were going to say it was the name of the file they objected to and then waiting for you to say you'd written a tool for bisecting the code to find the false positive line. – Flexo Nov 9 '11 at 18:47
  • @awoodland I started with bisecting (manually though), but this wasn't going anywhere -- reason being, as I later learned, that there where two objectionable sections. – balpha Nov 9 '11 at 21:23
  • I wonder, why did you use (new Date().getTime()%100)/10; and not just new Date().getTime()%10; (maybe that should be eleven)? – Time Traveling Bobby Nov 11 '11 at 14:17
  • 13
    Everyone knows that wmd = Weapons of Mass Destruction. Avira did the right thing here. – Pekka Feb 11 '12 at 17:36
  • It's back :/ – Shadow Wizard is Vaccinating Jul 18 '12 at 20:25
11

I have reported the false positive to Avira. They have fixed this issue.

This is what Avira replied to me:

The file '4c86f7c1.vir' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection is removed from our virus definition file (VDF) with the version: 7.11.17.94.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .