I’m on a friend’s computer (one I’m constantly fixing). Avast keeps popping up every few minutes or so (regardless if I’m using my web browser or not). It says it blocked a harmful web page (or two). The address is nothing I went to. I’ve gotten a few while typing this. Here’s one of them.
http://i.gyazo.com/dbcd0b4215f5da677f79e3e1d4ba6533.png
From what I can see, it’s as if I tried browsing for that site with Chrome. However, I didn’t. I assume there’s a malicious program on this computer trying to go to these various sites. Of course I can do a full scan, boot scan, or even offline scan. But this intrigues me. I want to figure out what is causing this.
No harmful programs in Startup (msconfig).
No harmful programs listed as an installed program.
No harmful programs running (as per Task Manager).
No harmful extensions.
Although I found some nasty services listed, their executables don’t exist and they weren’t running (just left over from when they were cleaned out). So nothing in the Services snap-in.
Under loaded drivers, I found a file {a3f28269-ad17-41a8-b032-3e0313ef8979}Gw64.sys. Systemlookup deems it malicious; however, Avast didn’t find it malicious. Removing it has not solved my problem.
http://www.systemlookup.com/search.php?type=filename&search=gw64.sys&s=
Now this is to the best of my knowledge. I even used UserAssist to see if I could track down what’s trying to browse to these sites.