Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Threaded View
I often get the WinXP Avast verbal warning when downloading usenet photos:
 Caution: Potential Infection Was Detected: Suspicious whitespace sequence

What is a "suspicious whitespace sequence" in a digital JPEG photograph?
Can I download the usenet photo and "see" the suspicous whitespace
sequence?

Is it really a virus?
If not, what?

donnie

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

donnie wrote:
Quoted text here. Click to load it

Delimiters


Yeah with an editor that can read the file and display it in a binary
format.

Quoted text here. Click to load it

No


Your friend Google will tell you.

http://www.google.com/search?hl=en&q=%22whitespace%22+delimiter&btnG=Search

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

donnie wrote:

Quoted text here. Click to load it

Isn't this the security whole in Windows graphics that could make
binary code inside a picture execute on the system if a fault
happened? Maybe that is what it is warning you about?

I have used avast! for several years and NEVER seen that message, so I
would be very careful with those images if I were you. Suspicious...
--
 Lars-Erik  -  http://www.osterud.name -  ICQ 7297605

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

donnie wrote:
Quoted text here. Click to load it

Maybe it's this?
http://en.wikipedia.org/wiki/Whitespace_ (programming_language)

--
Sue

Life may not be the party we hoped for, but while we are here we might as well
dance.
                Unknown

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence


Quoted text here. Click to load it

From what I've read the warning is about suspicious spaces in the filename,
not the image.

Some folks send executables with many spaces in the name, in hopes that the  
".exe" extension will be missed by the downloader.

--
Bert Hyman    St. Paul, MN    bert@iphouse.com

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Quoted text here. Click to load it

The problem is the filename ... and that fact that Avast is very cheap.

If you really want good coverage and fast performance, consider NOD32 from
http://www.eset.com

--
Thomas T. Veldhouse
Key Fingerprint: D281 77A5 63EE 82C5 5E68  00E4 7868 0ADC 4EFB 39F0



Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Thomas T. Veldhouse wrote:
Quoted text here. Click to load it
...

Fatally flawed argument, Thomas.  Apache is free as well but your
internet experience depends on it everyday.  The cost of Avast is fine
and, if you look at comparative AV tests, so is its effectiveness which,
really, is what matters.

Doesn't it?
Quoted text here. Click to load it

Y.a. fine option but, happily, OT for our group.

-Craig

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Quoted text here. Click to load it

The Avast method of using filename to block viruses/worms/malware/etc is what
is fatally flawed.  My comment about Avast being very cheap should be taken
contextually.

Quoted text here. Click to load it

I have chosen NOD32 because it works VERY WELL and impacts my system minimally
compared to all over antivirus/antimalware options that I have tried.  I
suggest it for that reason only.  It is your option to ignore my suggestion.

--
Thomas T. Veldhouse
Key Fingerprint: D281 77A5 63EE 82C5 5E68  00E4 7868 0ADC 4EFB 39F0



Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Thomas T. Veldhouse wrote:

Quoted text here. Click to load it

The e-mail methods of alerting can be setup by the user. So if you
don't like that you can disable it. It still uses many other methods
--
 Lars-Erik  -  http://www.osterud.name -  ICQ 7297605

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Quoted text here. Click to load it

Excellent.  I had doubts that it was picking up spyware or malware with any
accuracy.  Certainly, NOD32 was able to find things that Avast missed [as did
McAffee and the five minutes of Norton 360].  I do recall that everything it
found was stored in my cookies or a couple of zip files I had stored [inside
emails].

--
Thomas T. Veldhouse
Key Fingerprint: D281 77A5 63EE 82C5 5E68  00E4 7868 0ADC 4EFB 39F0



Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Thomas T. Veldhouse wrote:
Quoted text here. Click to load it

Uh, that's /one/ method used by, among others, Avast.  Another method is
file fingerprinting, etc.  Neither are unique to Avast.  If you've
somehow configured *any* AV to use this one method of detection, well,
yea, that decision was fatally flawed.

Quoted text here. Click to load it

I wasn't addressing your suggestion.  I was correcting an error in your
post.

-Craig

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Quoted text here. Click to load it

There was no error in my post.  What you didn't agree with is this:

"The problem is ...that Avast is very cheap."

Avast does not perform as well as several higher end scanners; most notably
NOD32 and Kaspersky.  You have to pay for both of these beyond the trial
period, which is why I posted it as such.  It was not a literal suggestion,
but one meant to be taken in context and just a little bit of salt.

--
Thomas T. Veldhouse
Key Fingerprint: D281 77A5 63EE 82C5 5E68  00E4 7868 0ADC 4EFB 39F0



Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

Thomas T. Veldhouse wrote:
Quoted text here. Click to load it
Acknowledged.  Thanks for the clarification and the bit of flavor enhancer.

best,
-Craig

Re: Avast Caution Potential Infection Was Detected: Suspicious whitespace sequence

donnie wrote:
Quoted text here. Click to load it

I believe It is an alert that is coming from the heuristic scanning of
avast in the mail scanner. I'm thinking that the email scanner is active
when you are viewing usenet posts.

Under the Heuristics tab click on "Customize".

On the next screen look for an Option called " Whitespace sequence check
in the name of attachment" with a setting number under it. Mine is set
to 5.

You can up this number to make it less reactive if you get this
frequently or even turn off this part of the scanner by unchecking the
option.

I suggest just upping the number a bit to maybe a value that won't react
when you get these photos instead of turning it off completely.

Site Timeline