-15

See this question: Trying to decode a virus

This page is blocked - it loads and then the page removed by ESET Endpoint Secuirty on my Laptop. The AntiVirus software states it has found code for PHP/Agent.NEH Trojan on the page.

This may be code that the question originator has put on the page as from the title tag it was something along the lines of he was trying to decode the virus (well duh).

I trust Eset, it's a fully paid up and valid Antivirus tool. The question has several upvotes and answers, so Can someone get into the page and edit the code text, add some comment characters or otherwise break the code into chunks so that I -- and others -- can load the page without the anti-virus detecting a false positive. I would prefer not to disable/unload the Antivirus.

Of course if the code text strings in the question are not the cause, something on that page is causing a detection alert and disconnection / page quarantine.

20
  • 1
    You expect me to click on that? Mar 28, 2015 at 20:31
  • 7
    @MartinJames It's in a code block. It can't do anything.
    – Mysticial
    Mar 28, 2015 at 20:31
  • @Mysticial lol - you know that 'cos you clicked on it! Mar 28, 2015 at 20:32
  • 12
    The question is harmless. Or as harmless as SO posts normally are. So, just configure your antivirus-program properly, or throw it out as trash. Mar 28, 2015 at 20:32
  • 1
    'Or as harmless as SO posts normally are' - lol! Mar 28, 2015 at 20:33
  • 3
    I don't understand the problem. Avoid the page. If you absolutely need to see it, disable your AV software just long enough to visit the page, and then re-enable it. The question contains a text literal that probably matches the virus signature, but there's no malicious content there.
    – Ken White
    Mar 28, 2015 at 20:33
  • 4
    I would tell you what's in the question, but you would probably lose access to this page as well. Mar 28, 2015 at 20:33
  • 1
    @MartinJames well, the question has answers and comments, so I'm hoping it's a false positive but the fact my Antivirus came back with PHP/Agent.NEH I'm not entirely sure, but I can't see it to judge for myself and my much better informed but much more trigger happy Antivirus thinks not.
    – Martin
    Mar 28, 2015 at 20:33
  • 3
    I do not believe in editing questions just because some weird Antivirus software reports a false positive.
    – itchee
    Mar 28, 2015 at 20:34
  • 4
    I just knew it would be PHP. Mar 28, 2015 at 20:34
  • 3
    PHP code in an HTML page displayed in a browser cannot be malicious. Antivirus manufactures should know this.
    – itchee
    Mar 28, 2015 at 20:36
  • @itchee I would not say it's a wierd antivirus, it's one of the best business AVs out there.
    – Martin
    Mar 28, 2015 at 20:36
  • @itchee: They certainly can if someone is sharing infected source code to get people to spread the virus. Mar 28, 2015 at 20:37
  • 1
    If you expect "business AVs" to not let you view anything that could be used somewhere as malware, then that's fine. I would instantly uninstall this piece of software, though.
    – itchee
    Mar 28, 2015 at 20:39
  • @Lightness: that is just awful.
    – itchee
    Mar 28, 2015 at 20:41

1 Answer 1

-6

I for one am glad AV picks this up. That's good. But you could put stackoverflow.com into your whitelist. Clearly nothing on this site will hurt you.

Editing the Q&A is a no-no, though. What would be its meaning, then?

4
  • 2
    Anti-Vlad? ....................... Mar 28, 2015 at 20:37
  • I think I'm more surprised than concerned. But cheers
    – Martin
    Mar 28, 2015 at 20:37
  • 8
    I disagree. Adding websites to whitelists is nothing one should do. Stack Overflow uses ads, for example. Ad providers are a common target for malicious software and hackers and this is nothing that Stack Overflow can directly control.
    – itchee
    Mar 28, 2015 at 20:44
  • @itchee: Well, any software that can't distinguish between a third-party ad network and a first-party site, these days, is likely to do more harm than good. Ad networks are so ridiculously common an exploit vector I have trouble imagining the AV companies aren't aware of that. Sep 21, 2015 at 3:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .