Avast performing an attack?

Question

I have a Toshiba notebook, which came with Norton Internet Security. In addition, I have installed Avast.

I received a warning from Norton about a OS Attack: GNU Bash CVE-2014-6271 intrusion attempt.

Norton "blamed" Avast, in my own computer, for the attempt.

How should I regard the warning?

More details follow.

1. I was at a hotel.
2. I had plugged an external long range Wi-Fi adapter for the first time in my PC. It was not operative since I do not have the drivers installed yet, but perhaps it was involved in the attack.
3. The report is attached below. It mentions 4 items involving 2 different IPs. It is confusing about who were the attacker and attacked. OFFICE2 is the name of my computer (unless some device replicated it).
4. My intention is to let go Norton when the trial period expires, but for the time being, both are active. The point in question here is beyond the convenience or not of having both active.
5. I have found only one link with a similar case. It is brief, and in Arabic, I guess.

Report:

Category: Intrusion Prevention
Date & Time:  15/09/2015 01:20:45 p.m.
Risk:  High
Activity:  An intrusion attempt by OFFICE2 was blocked.
Status:  Blocked
Recommended Action:  No Action Required
IPS Alert Name:  OS Attack: GNU Bash CVE-2014-6271
Default Action:  No Action Required
Action Taken:  No Action Required
Attacking Computer:  "OFFICE2 (10.100.105.51, 56941)"
Attacker URL:  10.100.100.1/cgi-bin/a2/out.cgi
Destination Address:  "10.100.100.1, 80"
Source Address:  10.100.105.51 (10.100.105.51)
Traffic Description:  "TCP, Port 56941"

Network traffic from <b>10.100.100.1/cgi-bin/a2/out.cgi</b> matches the signature of
a known attack.  The attack was resulted from \DEVICE\HARDDISKVOLUME4\PROGRAM FILES\AVAST 
SOFTWARE\AVAST\AVASTSVC.EXE.  To stop being notified for this type of traffic, in the
<b>Actions</b> panel, click <b>Stop Notifying Me</b>. 

Answer 1

This is probably an issue with the co-existance' of multiple realtime AV software. One will suspect the other one's activities as malicious.

Avast is trying to scan your router/default gateway and Norton flags it as malicious here. You should uninstall any of the two as soon as possible.

Running multiple AV's on the machine can have effects like low performance, instead of increasing security, it decreases the security level, more false positives etc. Instead of running multiple AVs you can supplement your favorite ONE with Anti-Malware tools like Malwarebytes antimalware or Hitman Pro and observe safe internet usage practices.

Also, when uninstalling any, be sure to use the removal tool provided by vendor. For Norton : Norton Removal Tool

---

Using more than one anti-virus program is not advisable. Why? The primary concern with doing so is due to Windows resource management and significant conflicts that can arise especially when they are running in real-time protection mode simultaneously. Even if one of them is disabled for use as a stand-alone on demand scanner, it can affect the other and cause conflicts. Anti-virus software components insert themselves deep into the operating systems core where they install kernel mode drivers that load at boot-up regardless of whether real-time protection is enabled or not. Thus, using multiple anti-virus solutions can result in kernel mode conflicts causing system instability, catastrophic crashes, slow performance and waste vital system resources. When actively running in the background while connected to the Internet, each anti-virus may try to update their definition databases at the same time. As the programs compete for resources required to download the necessary files this often can result in sluggish system performance or unresponsive behavior.

When scanning engines are initiated, each anti-virus may interpret the activity of the other as suspicious behavior and there is a greater chance of them alerting you to a "false positive". If one finds a virus or a suspicious file and then the other also finds the same, both programs will be competing over exclusive rights on dealing with that threat. Each anti-virus may attempt to remove the offending file and quarantine it at the same time resulting in a resource management issue as to which program gets permission to act first. If one anit-virus finds and quarantines the file before the other one does, then you may encounter the problem of both wanting to scan each other's zipped or archived and update files and each reporting the other's quarantined contents. This can lead to a repetitive cycle of endless alerts that continually warn you that a threat has been found after it has already been neutralized.

Anti-virus scanners use virus definitions to check for malware and these can include a fragment of the virus code which may be recognized by other anti-virus programs as the virus itself. Because of this, many anti-virus vendors encrypt their definitions so that they do not trigger a false alarm when scanned by other security programs. Other vendors do not encrypt their definitions and they can trigger false alarms when detected by the resident anti-virus. Further, dual installation is not always possible because most of the newer anti-virus programs will detect the presence of another and may insist that it be removed prior to installation. If the installation does complete with another anti-virus already installed, you may encounter issues like system freezing, unresponsiveness or similar symptoms as described above while trying to use it. In some cases, one of the anti-virus programs may even get disabled by the other.

To avoid these problems, use only one anti-virus solution.

---

Answer 2

Just to add, some anti-malware solutions work like a vulnerability assessment sometimes in an attempt to verify a vulnerability or weakness that can be exploited. This test "pattern" has a specific signature that will trigger an alert for other security solutions. For anti-malware software, it is better to have only one to avoid the conflict and confusion.

Answer 3

I encountered the same problem. It is indeed a false positive; Norton will alert you every few days, when Avast tries to perform certain scheduled actions. Repairing Avast using the Windows Uninstall/Change Program tool won't help, either.

Also, per my own experience, I was unable to open the Avast launcher to perform scans, or anything else for that matter. However, Avast functioned perfectly within my browsers- blocking sites, tracking, etc. If YOU PERSONALLY are Okay with decreased performance from Avast such as a lack of scanning, and are fine with receiving that notification from Norton... I actually recommend keeping Avast. And Norton. Avast beats even some of the browser add-ons listed here in finding things. Just be aware that's about all it can do while Norton is installed. Norton blocks the actions of most other antivirus programs. Pairing it with tools like MalwareBytes and Reason Core Security, which it won't conflict with, can make quite the security suite.

I know a lot of people don't like Norton, but anecdotally, it DOES find stuff no other Antivirus I've ever used does, as far as real-time protection. So I'm not sure I understand the animosity, aside from the fact it's paid protection, and USED TO suck, once upon a time. There was a period of a couple years where Norton wasn't keeping up with other similar free programs. And it got a reputation as a result. I'm using the free trial currently; when it expires, I'll go with Avast only. But in the meantime, I'll take advantage of the unique strengths of both, and recommend others do the same.

Answer 4

I have several PCs in my home network. Norton Endpoint Protection is installed on one of them and Avast! protects the others.

Avast! seems to carry out a kind of network vulnerability check once in a while and Norton detects the check as an attack of WannaCry and gives me a security alert.

The workaround to stop the annoying alert messages is to prevent Avast! from scanning your network vulnerability. You can go Avast! > Setting > General > Smart Scan and turn off the Network Scan feature.

This solution worked for my environment.