btrll.com certificate error

Viruses and worms
1

Hello,

I have been working with Avast Technical Support, and they suggested I post here.

Only in Yahoo Mail, I am getting the Certificate message shown in the attachments, issued to “*.btrll.com”, issued by “avast! Web/Mail Shield Root”.

Things I have tried:

  1. Avast Full Scan, and Boot Scan, using 12.1.2272 with latest virus definitions
  2. Malwarebytes Anti-Malware 2.2.1.1043 full scan
  3. latest version of adwcleaner
  4. latest version of adware removal tool 5.1
  5. latest version of bitdefender adware removal tool

All these did not find any problems.

I have also verified there are no tasks running on my machine with btrll included, no files matching btrll, and no registry entries.

Based on comments in my topic under the Avast Free forum, other people are having the same problem.

Any help would be greatly appreciated.

Thank you.

2

see instructions here >> https://forum.avast.com/index.php?topic=53253.0

Scroll down to the second picture Farbar Recovery Scan Tool run as instructed and attach the two diagnostic logs here

3

Here are two requested logs.

4

Now you wait for essexboy to come online and check logs. It may be some hours wait

5

Nothing strange in the log files except event-ID 4101 which can be the cause.
Possible solutions > http://tinyurl.com/j9g6szj

6

I found the error in EventViewer and manually installed the certificate.

Something else I found in EventViewer that might help with this problem. Why is Avast keeping all these Certificate entries open?

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
15 user registry handles leaked from \Registry\User\S-1-5-21-4117394973-3887961457-477505670-1001:
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Microsoft\SystemCertificates\SmartCardRoot
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Microsoft\SystemCertificates\Root
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Microsoft\SystemCertificates\Disallowed
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Microsoft\SystemCertificates\TrustedPeople
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Microsoft\SystemCertificates\trust
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Policies\Microsoft\SystemCertificates
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Policies\Microsoft\SystemCertificates
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Policies\Microsoft\SystemCertificates
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Policies\Microsoft\SystemCertificates
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Microsoft\SystemCertificates\My
Process 1256 (\Device\HarddiskVolume2\Program Files\AVAST Software\Avast\AvastSvc.exe) has opened key \REGISTRY\USER\S-1-5-21-4117394973-3887961457-477505670-1001\Software\Microsoft\SystemCertificates\CA

7

fixing the 4101 error has not solved the certificate problem

8

Something I have noticed is that normally Yahoo Mail displays two ads on the right of the screen. If the certificate message is seen once then only one ad is seen, if it is displayed twice (one right after the other) then no ads are displayed.

Anyone have any idea how to contact Yahoo about their ad server being corrupted?

9
Anyone have any idea how to contact Yahoo
Have you tried a google search or yahoo support site
10

Yes, but they lead to yahoo answer forums or yahoo web pages, none of which contain any way to directly contact Yahoo

11

The link to contact Yahoo is on the support site, but very hard to find.
I have found it a while ago and it was a pain to find it >:(

12

For help with Yahoo, try this:
https://forums.yahoo.net/

13

running AdBlock Plus for IE does make the problem go away, but doesn’t solve why it is happening.

I have been working with Yahoo (both customer service and online forums) and have not gotten any useful help or suggestions.

I have currently run ten different malware/pup scanners and nothing found by any.

Does anyone have any suggestions?