Avast is blocking an IP adress all over again

Viruses and worms
1

Hello. This is my first topic on the avast forum so please don’t judge :). Today (16 may 2015) avast blocked for 4-5 times the same IP adress ( Infection : URL:MAL). I was just browsing youtube, facebook and deviantart.

Can you explain me what the problem is?

Thanks

2

Hello,

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

3

Okay . The scan is running . To be mentioned that avast now blocked like 200 times the same IP adress . I don’t know what is going on . Today i’ve encountered this problem.
I will post the files when scan is finished

Thanks

4

Files

5

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

6

Okay . Should I attach the file or copy paste the content . Problem not solved at all after that scan . But at least not 200 pop-ups just 2 :slight_smile:

7

Please attach reports.

Also, can you make a picture of pop-up?

8

Here

9

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Make sure that Addition option is checked.
[*]Press Scan button and wait.
[*]The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

10

Hello.

I have the same exact IP and the same url block message appearing. Before this it was an IP from an University in Berlin, now it’s from Timisoara, Romania.

11

My problem is solved for now . Rebooted the system after scanning with zoek and everything is working fine . If Avast pop-ups again , I will rewrite on this thread.

Thanks for the support and solution :slight_smile:

Have a nice day :slight_smile:

12

One more thing . Should I remove those softwares you’ve suggested me?

13

The same thing is happening to me, from the same address as op (the processes that were responsible were chrome and opera).
If it helps I’m attaching the requested files.
While googling I’ve come across: MiniToolBox; in the log file generated in the IP configuration section there were 10 IPs similar with the one blocked by Avast: 82.77.159.xxx. (I’ve attached this log as well: Result.txt). I’ve blocked this range with the firewall for now… I’ve looked in the hosts file for them but they were not there; (tried ipconfig /flushdns but MiniToolBox still found them; these IPs are associated to google.com now):
Name: google.com
Addresses: 2a00:1450:400d:806::200e
82.77.159.246
82.77.159.236
…

Thank you.

14

@lucaslk

• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

@Everyone Else

Please start your own topic.