Avast popping up a URL:Mal alert every time Skype ads roll over

Viruses and worms
1

See the attached screenshot. I’m on the latest version of Skype, 7.16.0.101. Currently IMing with someone. For the past hour or so, every time the ad on the top of the IM window rolls over (though I’ve actually never seen an ad on Skype…the MSN logo just rolls over every now and then), Avast loses its little mind. I’m not the only one, either.

I’m completely confident my computer is secure. I’ve never accepted any files via Skype, nor clicked on any untrusted links. Malwarebytes Free can’t find anything. Is this something screwed up on Microsoft’s end, or Avast’s? Like I said, I’m not too worried, but the alerts are pretty annoying.

2

Let’s get a closer look behind the scenes :wink: …

Please follow the directions for scans in this topic and attach as many of the logs as you can run.
Logs to assist in cleaning malware

FRST.txt, Addition.txt, Malwarebytes Anti-Malware log and aswMBR.txt. Thanks.

3

The IP is blacklisted for (but not limited to) sending spam.

4

I’ve encountered this too, and so has lots of other Skype users who also have Avast it seems, my topic here: https://forum.avast.com/index.php?topic=180342.0

With me, it seems that Avast has blocked Skype advertisements all together since it only shows white block there where Skype ads should be. :-\

5

url:mal = IP block

It has nothing to do with Skype or the advertisements they show.
It has to do with malicious activity going on from that IP.

6

It is the Skype Banner Ad virus on that IP that is being blocked: -com.clickagy.aorta.request.HttpNotFoundException:
at -com.clickagy.aorta.netty.AortaRequestExecutionHandler.channelRead(AortaRequestExecutionHandler.java:92)
at -io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:308)
at -io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:294)
at -io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103)
at -io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:308)
at -io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:294)
at -io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:103)
at -io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:308)
at -io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:294)
at -io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:244)
at -io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:147)
at -io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:308)
at -io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:294)
at -io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:846)
at -io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:131)
at -io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:511)
at -io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:468)
at -io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:382)
at -io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:354)
at -io.netty.util.concurrent.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:110)
at -java.lang.Thread.run(Thread.java:745)
Also reported on this Russian forum: http://www.slackserv.com/forum/viewtopic.php?f=247&t=20544
They report there that newer version of Skype started to give inferior user privacy protection, but here it is this adware virus.
and users are being protected by Avast AV!

polonus

7

Too bad I cannot read russian. :-\ So it seems that it wasn’t just a false positive… So tje source of this is in 3rd party advertisements served trought Skype and not something inside the Skype itself on users’ computers?

I guess Avast is enough to keep these particular infections away, but what about people who don’t use Avast? I have lots of irl friends in my Skype contacts but I’m not really sure how many of them uses it. :-\

EDIT: I was able to find this tutorial on Skype forums that shows how to disable Skype ad banners: http://community.skype.com/t5/Windows-desktop-client/Tutorial-How-to-disable-Skype-advertisements/td-p/3316902 I used it and it seemed to have worked

8

Hi forum friend Pernaman,

Yup, the Russian translation on the fly is only one click away for me through the Google Translator Tooltip Expanded script I have installed via TamperMonkey. Dutch is my first language, English, German and Polish second languages for me. Also on Chinese and japanese and Modern Hebrew/Ivriet txts for instance Google Translator does a excellent job now. Check for a good Chinese translation that there is a difference given for the translation of “big brother” and “small brother” and you will be fine to go with your Google online translator.
Language can also be a factor to determine where txt’s or analysis stem from, in UK for instance we have the word, “fish fingers”, in Germany and the Netherlands the term is “fish sticks”. To determine this was a complete advanced science at pre-war German Universities, now you have a lot of professors that struggle with their antique languages, in the “kali yuga-period” we all live in this knowledge will only become less common, as my online guru F.RAVIA (R.I.P.) once taught me.

Damian