Am I being scammed by Avast?

General Topics
1

Last night I kept getting popups from Avast. SysWOW64 is a legitimate file in windows 7 64 bit

Avast has blocked malicious URL.
Infection Details
URL: 91.217.153.48/where/mJKV_1OPWfcfbTTQYYOI…
Process: file://C:\Windows[b]SysWOW64[/b]\xactengine2_6…

I ran every scan I could think of. From more than one site including a full virus scan from Avast. This would pop up over and over again.

Then this site came up. http://www.avast.com/en-us/lp-security-information-fp?utm_campaign=Virus_alert&utm_source=prg_fav_60_0&utm_medium=prg_systray&utm_content=.%2Ffa%2Fen-us%2Fvirus-alert-default2&p_vir=al&p_prc=file://C:\Windows\SysWOW64\xactengine2_632.exe&p_obj=91.217.153.48/where/mJKV_1OPWfcfbTTQYYOIcUREUWPTTfIRYdbIEO-6XBB_1TQQU-6GF5_1WTOW-gRPE-6LC6_1U-gW-gIUQW-gE-tsDF6K5D_rpX51_rW-t9DVKX5D8GDF-66FC_1Q_fQ_fQ_fQ_fQ_fQ_fQ_fQ_fTI-62BG_1Q-672V_1WTQU-6D85_1W-6N8J_1Q-6252_1WQRR-69LV_1-65GZ_1W-6N54_1ETE-6&p_var=.%2Ffa%2Fen-us%2Fvirus-alert-default2&p_pro=0&p_vep=6&p_ves=0&p_lqa=0&p_lsu=24&p_lst=0&p_lex=362&p_lng=en&p_lid=en-us&p_elm=7

Whats up with this?

The security center page said,
[QUOTE=]Yes, that was close, but relax…

avast! Free Antivirus is the minimum protection anyone should have against viruses and spyware. If you spend a lot of time online, however, you are naturally exposing yourself to greater threat. Fortunately, you can increase your security by adding more defensive layers.
[/quote]
So I can get rid of this pop up if I buy the full version? Sounds like a scam to me. So I deleted my avast and installed AVG. Ran a full scan including a boot scan and I have nothing.

I prefer Avast but I want to know if this is a scam? If someone can help me I will delete AVG and reinstall Avast

Thanks

2

It isn’t a scam. Your Avast blocked the malicious URL, saved you computer from being infected and informed you of that fact.

3

SYSWOW64 isn’t a file (so can’t be a legit file) but a folder and there is something in it that is trying to connect to a malicious site and avast is blocking that action. Having the AIS version would only change the information displayed in the secondary window (when you click the More Information window, I wouldn’t bother doing that). But it wouldn’t stop the act of that process trying to gain access to what avast considers a malicious site.

So whatever this is xactengine2_6… (could be another folder or file name, but it has been concatenated, the … bit at the end of the process line. It may possibly be this xactengine2_6.dll file but that could in itself be being misused.

Do you have the full path to this file ?

The fact that you don’t have avast installed any more you probably don’t have this information, this makes it very hard for us to investigate or suggest avast options to try and find what is the true cause.

I know one thing for sure I wouldn’t be switching to AVG because my current AV is throwing up alerts (no matter which that was). The first action is to investigate not migrate as if the alert is legit which I believe is likely, and AVG isn’t detecting this what have you let yourself in for.

See image, whois for the IP address that it is trying to connect to is in the Ukraine.

EDIT: See additional image showing and avast alert when checking this IP out and its poor reputation, also see http://www.mywot.com/en/scorecard/91.217.153.48

4

I was quite mistaken it seems. Obviously I was infected by a virus and yet no scan was detecting it. I was just a bit confused by the website asking me to download the full version when no virus was showing up.

I think I had a redirect virus. Still not so sure if it is gone but I think it is. I redownloaded Avast again. I think I have gotten rid of this.

Thank so much. Feel free to delete this post.

5

How did you get rid of it as deletion of the file concerned could well break something if it is a valid file.

So this still needs analysed: