Virus report warning each time I access a Stack Overflow page:
Screenshot:
Script in question: http://cdn.sstatic.net/js/wmd.js?v=4299f69ea585
Meta Stack Exchange is a question and answer site for meta-discussion of the Stack Exchange family of Q&A websites. It only takes a minute to sign up.
Sign up to join this communityVirus report warning each time I access a Stack Overflow page:
Screenshot:
Script in question: http://cdn.sstatic.net/js/wmd.js?v=4299f69ea585
You may want to take this to your AV Software vendor. This is clearly a false positive on their end.
Edit: Okay, here's what I did. I found some website where you can upload a file, and it'll scan it with twenty different virus scanners. And sure enough, Avira (and only Avira) considers wmd.js
(that's the Markdown editor) to contain a virus.
So after deleting stuff from the file here and there, reuploading the changed version, waiting for the scan, checking whether it's still a "virus", readding something or removing something else, rinse and repeat (anywhere between 20 and 50 times; I didn't keep count), I finally found why Avira considers us to be spreading viruses:
Math.random()
!Two places use a random number in that file:
Just removing the random number from 1 is fine, since there's also a "current time" part in the IFRAME id.
I replaced the Math.random() * 10
from 2 by (new Date().getTime()%100)/10;
, which is good enough for that use case.
Removing just one of the two still triggered the virus scanner; but removing both stopped it.
This has been deployed, so this stupidity should be over now. Thank you Avira, this was fun. Not.
Math.random()
implementations in various browsers are/were kind of weak and prone to information leakage. It seems absurd that an AV program would classify a script based on that, though.
– Tim Stone
Nov 8 '11 at 17:12
(new Date().getTime()%100)/10;
return the same value if requested by multiple tabs at the same time, making it a poor choice for that use case?
– Kevin Vermeer
Nov 8 '11 at 17:12
(new Date().getTime()%100)/10;
and not just new Date().getTime()%10;
(maybe that should be eleven)?
– Time Traveling Bobby
Nov 11 '11 at 14:17
I have reported the false positive to Avira. They have fixed this issue.
This is what Avira replied to me:
The file '4c86f7c1.vir' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection is removed from our virus definition file (VDF) with the version: 7.11.17.94.
HTML/Rce.Gen
I love generics/heuristics. I'd say this is not a bug on the SE side. – Time Traveling Bobby Nov 8 '11 at 9:05