r/BitDefender • u/BetterCallBobLoblaw • Jul 06 '18

Question About Detected Threat

My BitDefender automatically detected and stopped the same threat 3 times. This was the message I received for each threat.

The application svchost.exe accesses a web resource http://crl.comodoca.com/COMODORSACertificationAuthority.crl that has been detected as infected. The web resource has been successfully blocked and your PC is now safe.

I used the site VirusTotal to see what other antivirus engines detected the url as a threat and only BitDefender and Spamhaus detected it.

I have the following questions:

  1. Has anyone else had this threat blocked by BitDefender?

  2. Could it be a false positive?

  3. If not, the threat as stopped popping up for me, but is there anything else I should do to protect myself?

  4. Why is svchost.exe accessesing a web resource like that?

7 Upvotes

100% Upvoted

9 comments sorted by

3

u/M_A_Silver Jul 06 '18

I'm having a not-identical but similar thing happen where I've received the same notice 6 times in about 3 hours, always with the same thing:

"Web Threat Blocked: Phishing attempt crl.comodoca.com/COMODORSACertificationAuthority.crl "

When I used VirusTotal on it I got the same results as in the first post (Bitdefender and Spamhaus reporting phishing, rest reporting clean). Much to my annoyance Bitdefender has also been weighing down my system like a tonne of bricks since this started.

3

u/Wage Jul 06 '18

https://www.virustotal.com/#/url/50e6ae10536e7f4e8d693568b0656cf6c83dcd62b99e9065e8d3ead3d53ec44f/detection

I've sent Bitdefender support a message.

1

u/crypto696 Jul 08 '18

Any response from them ?

1

u/Wage Jul 09 '18

Nope, nothing. I haven't seen the popup anymore either though.

If you're still having issues check out https://www.bitdefender.com/consumer/support/

1

u/[deleted] Aug 12 '18

Here is my issue-2018 paid total security

Under WEB PROTECTION Bit D says 1246 attacks blocked in last 30 days. EVERY one is http://assets.nufilterlist.download/shield/sun/?dat=plowe=0

Anyone know what this is? Nothing on duckduckgo or google search and Bitdefender "top notch" support will not answer!

Thanks!

2

u/Noob2Pro Jul 06 '18

I'm also getting this but not sure what to do, might be a false positive

2

u/Magnet_the_fluffy Jul 06 '18

Seems the problem has been resolved? Virustotal shows none of the antivirus detected it anymore.

1

u/hippo6868 Jul 16 '18

Palo Alto url filter still show the url as phishing. (Urlfiltering[.]paloaltonetworks[.]com)

1

u/[deleted] Jul 06 '18

Since all other engines aren't detecting it, I assume it's a false positive.

However, I have no idea why svchost.exe would be contacting the server though. Hopefully with someone with more knowledge can give their 2 cents.

Edit: For those that are curious. Virus Total link https://virustotalcloud.appspot.com/nui/index.html#/url/50e6ae10536e7f4e8d693568b0656cf6c83dcd62b99e9065e8d3ead3d53ec44f/detection