Folder AVG Forums » Archive » Archive » AVG 9.0 Free Edition » False Positive? - HTML/Framer
Page 1 of 5 1234››
July 15, 2010 00:24 False Positive? - HTML/Framer #98113
Top
Mikew_nt

Avatar

Novice
Join Date: 28.10.2009
Posts: 18
I just got back from vacation today and fully updated the computer, including AVG to 3005.

When my wife goes to the landing page for her Yahoo Mail using IE8 (we are on W7HP), AVG resident shield detects HTML/Framer.

I had a hard time believing that Yahoo Mail landing page is infected.

I scanned the indicated files with SuperAntiSpyware and MBAM, and neither report any virus or malware.

I would upload to Virus Total, but those files are system protected, and I could not upload it.

For the time being I have used AVG to quarantine the indicated file.

I have done a system scan with SAS and MBAB, and neither find any infections either.

I also went to a different computer which has Avast as the AV, similarly configured for resident guard detection, and it did not report any problems either.

I have sent an email inquiring about a false positive on this to virus@avg.com. I would have liked to attach the file, but could not due to same issues as above for Virus Total.

Has anyone else seen this problem, and is it a confirmed false positive? If so, is there an update coming to fix this?
July 15, 2010 00:52 Re: False Positive? - HTML/Framer #98123
Top
rogerpro

Avatar

Novice
Join Date: 15.7.2010
Posts: 2
I'm getting the same results and it started today. Also scanned with MBAM with no results. I'm thinking false positive as well.

Also I should add that the file indicated as infected is recaptcha_ajax.js. It happens with IE8 and Firefox (both up to date).
July 15, 2010 01:09 Re: False Positive? - HTML/Framer #98125
Top
Koltus

Avatar

Novice
Join Date: 15.7.2010
Posts: 2
My wife is getting this to. What to do about it?
avg problem.jpg
July 15, 2010 01:10 Re: False Positive? - HTML/Framer #98127
Top
highlandertn

Avatar

Novice
Join Date: 15.7.2010
Posts: 2
I'm getting the same error whenever I go to http://Slickdeals.net and when checking Yahoo mail. I did some digging in the forums and found this from one of the admins:

Please be informed that mentioned detection is on html webpages, which contains hidden frame in source code ... <IFRAME ... style="visibility: hidden"></IFRAME>, which points to some infected website.

If the hidden iframe code is removed, the file/webpage is cleaned.
July 15, 2010 01:15 Re: False Positive? - HTML/Framer #98129
Top
Mikew_nt

Avatar

Novice
Join Date: 28.10.2009
Posts: 18
I saw the same quote in one of the threads, but again, I have a hard time believing that Yahoo Mail is infected.

Also, Avast has similar checking of html frames and references to malicious websites, and it did not trigger anything, so I tend to believe this is a false positive.

I look forward to AVG addressing and clarifying the issue.

highlandertn wrote
I'm getting the same error whenever I go to http://Slickdeals.net and when checking Yahoo mail. I did some digging in the forums and found this from one of the admins:

Please be informed that mentioned detection is on html webpages, which contains hidden frame in source code ... <IFRAME ... style="visibility: hidden"></IFRAME>, which points to some infected website.

If the hidden iframe code is removed, the file/webpage is cleaned.
July 15, 2010 01:23 Re: False Positive? - HTML/Framer #98133
Top
JonathanN88

Avatar

Novice
Join Date: 15.7.2010
Posts: 4
Having the same problem with Amazon.com of all places, when I click on the new or used link of an item for pricing it wont open the page and gives me a report saying its a HTML/Framer virus. Opera and IE open Amazon and its pages fine. Having this problem with Firefox and Chrome.

I am also using the paid version of AVG with home security 3 pack.
July 15, 2010 01:25 Re: False Positive? - HTML/Framer #98135
Top
JonathanN88

Avatar

Novice
Join Date: 15.7.2010
Posts: 4
Now it wont even let me get onto the Amazon home page... :angry:
Clipboard01.png
July 15, 2010 01:37 Re: False Positive? - HTML/Framer #98139
Top
spelingchampeon

Avatar

Novice
Join Date: 15.7.2010
Posts: 3
Never had this 'html/framer' issue before, but tonight, I go to Amazon.com and get an alert about the virus. I ran a scan on the folder and there were 82 other 'framer' issues. What bothers me the most is, this happened on the main page of Amazon, which I visited for the 1st time today. SOOOO, that means the 'framer' files have been here longer than 2 hours, but have never triggered anything before. Could it be the 3005 database?

July 15, 2010 01:55 Re: False Positive? - HTML/Framer #98145
Top
ugly_girl4_ugly_guy

Avatar

Novice
Join Date: 15.7.2010
Posts: 16
I think it's 3005 too. I was fine until I updated around 12:30 today. The only website I've come across with this issue so far is www.chron.com .
July 15, 2010 02:02 Re: False Positive? - HTML/Framer #98149
Top
coward666

Avatar

Novice
Join Date: 15.7.2010
Posts: 4
I think you are wrong about false positive, this thing is replicating itself. I am not even using internet, and avg is seeing it replicating. It looks to me to be a new bug nobody has seen before. I think with patients avg will cure this, it is just so new. Correct me if I am wrong Mr. moderator dude!!!!!!!!!
Page 1 of 5 1234››