Thread Info
  • Locked Locked
  • Replies 5 replies
  • Subscribers 3 subscribers
  • Views 11501 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UBISOFT UPLAY Download of Assassins Creed 4 Black Flag being detected as CXweb/ZAccess-A

CyrusLeander

So UBISoft currently have Black Flag available for free at the moment. So I thought I would donwload it all 24.93GB of it. Just when I thought it was almost finished the download failed, saying I did not have Internet Access. As my Internet was fine I checked the logs on my UTM (Home license) and noticed the following:

 

2017:12:14-20:38:59 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="24913" cattime="744" avscantime="437369" fullreqtime="1108839" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:00 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="403" cattime="897" avscantime="426622" fullreqtime="1034505" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:01 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="583" cattime="597" avscantime="418660" fullreqtime="1373946" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:02 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="196" cattime="550" avscantime="421622" fullreqtime="1317391" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:03 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="412" cattime="882" avscantime="429953" fullreqtime="1036475" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:05 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="483" cattime="903" avscantime="420771" fullreqtime="1627163" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:06 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="419" cattime="988" avscantime="420448" fullreqtime="1291610" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:07 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="446" cattime="813" avscantime="431026" fullreqtime="1030103" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:09 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="197" cattime="299" avscantime="420695" fullreqtime="1269780" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"


2017:12:14-20:39:10 e200utm httpproxy[5809]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="GET" srcip="x.x.x.x" dstip="2.18.65.115" user="" group="" ad_domain="" statuscode="403" cached="0" profile="REF_HttProContaInterNetwo (containing XXXXXXX)" filteraction="REF_HttCffDefauConteFilte (Default content filter action B)" size="3070" request="0xdb6bd600" url="uplaypc-s-ubisoft.cdn.ubi.com/.../0E0FA9CE2271D883FCA4F1C59998A167D0781247 referer="" error="" authtime="0" dnstime="425" cattime="924" avscantime="435453" fullreqtime="1316851" device="0" auth="0" ua="Massgate" exceptions="" category="116" reputation="trusted" categoryname="Games" sandbox="-" content-type="application/x-dosexec" virus="CXweb/ZAccess-A" engine="SAVI"

 

It would seem that the UTM has taken exception to the final part of the download and classified it as CXweb/ZAccess-A !! I would imagine this is a False Positive, but how do I prove / rectify this. Is my only option to create an exception?



This thread was automatically locked due to age.
Parents

  • Can confirm. I got the same results running 9.506-2

    The AV scanning is flagging a false positive on coming from a legit Game seller Ubisoft.

    This is the Home version for my family so sandstorm isn't enabled.

    Sophos Home Prem AV beta scanned nd hasn't flagged anything on the PC after downloading so i'll trust the content on faith for now.

     

    I didn't want to create rules or leave a hole open forever so I jumped into:

    Web filtering - web protection - (look to the lower right) default content filter action - Antivirus tab - I just turned all AV off.

    Finished the tiny file (sub 1MB) then then turned AV scanning back on like the above steps.

    This is on a HOME network with fairly low risk and low security threat. Please keep in mind the above is not a best practice and represents a large hole in security while used.

  • in reply to DrewThomas

    Drew, did you try the idea in my post just above yours?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply Children
No Data
Unfiltered HTML