0

When HTTPS scanning is enabled in a client's Avast antivirus software (on a Windows machine) and they try to access the site, they get the messages below and the site doesn't load. If I turn HTTPS scanning off, the site loads without issue.

From Google Chrome:

This site can’t be reached The connection was reset. Try: Checking the connection Checking the proxy and the firewall Running Windows Network Diagnostics ERR_CONNECTION_RESET

From IE:

This page can’t be displayed Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to [site here] again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator.

Avast Antivirus Pop Up

We've safely aborted connection on [site here] because it was infected with URL:Mal.

What are some things on a site that could be meeting Avast's criteria for malware and causing it to show these messages on the browsers?

Troubleshooting I've done

  • I checked all pages and removed any links that do not start with https
  • I've entered the site in google's safe status and malware page to check for any malware and it doesn't find any.
  • Contacted Avast: their recommendation was to ask each client to add the site to their exclusion list. I may not know a potential client or have contact with them to be able to ask them to add the site to their exclusions list -- I would rather remove whatever is tripping Avast.

Additional information

  • SSL on the site is active
  • Domain is managed by Squarespace and active (paid for)
  • There is also a built-in domain that never expires
Improve this question
4
  • I suggest you pursue this more intently with Avast. Use Virustotal.com to confirm your site is clean. If it is, the suggestion that you add exclusions to client machines is utterly ridiculous and they need to be called out on that.
    – I say Reinstate Monica
    Commented Dec 29, 2018 at 1:59
  • You have two options, add an exception so the website is allowed, or report the issue to Avast and wait till an update is issued that allows it. There is no mechanism to share information privately. This is purely and 100% an issue with how Avast scans encrypted traffic. This security feature, breaks the internet, and makes secure encrypted traffic insecure, by requiring Avast to use a fake certificate allowing allowing it to scan encrypted traffic. There isn’t anything you can do except add the exception allowing the website or disable SSL on the website entirely
    – Ramhound
    Commented Dec 29, 2018 at 2:28
  • 1
    @TwistyImpersonator, thank you. I will call them again and send an email to their customer service. I used Virustotal.com and it came back clean.
    – allics
    Commented Dec 29, 2018 at 22:45
  • @Ramhound, thank you for the information on how the security feature works. I will be reporting the issue to Avast.
    – allics
    Commented Dec 29, 2018 at 22:46

1 Answer 1

Reset to default
1

Reported a false positive to Avast at https://www.avast.com/en-us/false-positive-file-form.php and they cleared the site's reputation in their database. Clients using Avast are now able to access the website.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .