Google search raises URL:Blacklist pop-up

[Jan593]

Thank you for the tips, we will look into both CrossPilot and Proxy SwitchySharp if there is any hidden malicious code!

[Tom581]

@Jan593 post:20

@Tom581 post:10

Thanks Jan953…
I started FFox with add-ons disabled and no problem. After restart, I tried disabling add-ons one-by-one but can’t figure out the culprit. Only one has been updated in the last week or two, but I fully trust it.
Is there a way to effectively troubleshoot this? Is the a scanner of some sort out there?

Unfortunately, I don’t think there is any good tool to automatically troubleshoot this. But what you can do is navigate to a Google search page, and open “Web Developer” → “Debugger” → “Sources”. You should see there on the left pane the list of add-ons that are executing a content script in the current page. If there is any add-on that should not be loaded into a Google search page, you found the culprit.

Thanks again Jan953…
Problem has apparently disappeared.
Yesterday, I disabled all add-ons (not restart with add-ons disabled) and turned them back on one at a time and checking for the issue each time. Even when all were back on, problem did not surface. I waited to post today to see if issue came back after reboot. It did not.
Cannot explain this.
Tried your troubleshooting and did not notice any add-ons loaded.

[GEGEPING]

Hi,

I have answer from Avast French support ;D

They said that it was from a bad add-on…

They advise me to disable add-on one by one and enable it one by one to see which one was bad.

I did it, but as a forumer said before, they did it without possibility to know which one wasn’t good :o :o

Gerald

[Tom581]

@Tom581 post:22

@Jan593 post:20

@Tom581 post:10

Thanks Jan953…
I started FFox with add-ons disabled and no problem. After restart, I tried disabling add-ons one-by-one but can’t figure out the culprit. Only one has been updated in the last week or two, but I fully trust it.
Is there a way to effectively troubleshoot this? Is the a scanner of some sort out there?

Unfortunately, I don’t think there is any good tool to automatically troubleshoot this. But what you can do is navigate to a Google search page, and open “Web Developer” → “Debugger” → “Sources”. You should see there on the left pane the list of add-ons that are executing a content script in the current page. If there is any add-on that should not be loaded into a Google search page, you found the culprit.

Thanks again Jan953…
Problem has apparently disappeared.
Yesterday, I disabled all add-ons (not restart with add-ons disabled) and turned them back on one at a time and checking for the issue each time. Even when all were back on, problem did not surface. I waited to post today to see if issue came back after reboot. It did not.
Cannot explain this.
Tried your troubleshooting and did not notice any add-ons loaded.

Seems this idiocy is back again. 6 days of freedom and now it is starting again. Nothing has changed in my system.

[GEGEPING]

Hi,

Welcome back >:( >:( >:(

I have the issue back.

To see if something wrong with add-on, which add-on do you have on your firefox or other navigator which occur the problem?

Gerald

[Tom581]

@GEGEPING post:25

Hi,

Welcome back >:( >:( >:(

I have the issue back.

To see if something wrong with add-on, which add-on do you have on your firefox or other navigator which occur the problem?

Gerald

No idea Gerald. Did the same test as before and problem is still there with add-ons disbaled without a FFox restart. I am baffled.

[lorenzorodriguezmain]

Hi everyone,
I’ll be copying this other reply of mine on the AVG forum:
I know it might not be what you’re exactly looking for (since it’s more probable you’re being closely monitored as I am and this is only going to prevent you from viewing the window - check the address loaded on the pop-up, because it’ll match a ton of your latest searches on Google), but, at least for now, you could edit the hosts file present at the path “C:\Windows\System32\drivers\etc” and block the address from being sucessfully opened. Remember you’ll have to run the text editor (notepad, why not?) as an administrator and open the file through the own notepad prompt (ctrl + o). After this, go to the last line and create a new one with “127.0.0.1” (which is the localhost used for loopbacks; learn more at https://en.wikipedia.org/wiki/Localhost) plus the address targeted. You also should preferably press the “tab” key to separate a parameter from each other.
It seems this threat actually comes from some kind of action triggered by Crosspilot. Discussions are being proposed across other forums too, I see.
Hope this helps.
(I attached a sample of what it also looks when running on AVG. Same deal, same issue.)

[Jesperodde]

I got this from Avast:

If the detection pops up randomly it is possible that you have hijacker in your browser. To get rid of it please follow steps described bellow:

1. Make sure that Avast is up-to-date: https://support.avast.com/en-ww/article/Update-Antivirus
2. Reset the affected web browser to its default/factory settings: https://support.avast.com/en-ww/article/Reset-browser

Did not do it yet, did anyone else?

[DavidR]

You could start by attaching a screenshot (to your reply) of the avast alert, that could help us investigate.
See my attached image on how to attach it in the post.

[Jesperodde]

Ok, this is the screenshot

[DavidR]

This pretty much confirms the detection, that an Avast Team member posted about.

@Jan593 post:7

Hi,

servscrpt[.]de is a domain used by a malicious payload to spy on Google/Bing/Yahoo search results and modify them. It has the ability to redirect arbitrary search results through servproc[.]de. This is most likely spread by a malicious browser extension: we recommend disabling suspicious ones and checking if the issue persists. If you figure out which extension was to blame, please let us know.

And also what actions others in this topic have taken to try and pin down what add-on is triggering this alert.

But what you got from avast in your Reply #27

1. Avast being up to date (virus definitions) wouldn’t have an impact unless this were a false positive.
2. Resetting the browser back to defaults, would presumably remove all add-ons and probably resolve the problem until you put the add-ons back again.

So it doesn’t seem to follow what ‘Jan593’ suggested, to track down the add-on responsible. Or what other contributors to this topic have done to try and find the add-on. All I as an Avast user can suggest is read through some of the other replies on what they have done to find the add-on and then remove that add-on.

[Jesperodde]

I only removed CrossPilot (which I never asked for by the way) and now peace has returned - no more alerts. What IS CrossPilot???

[Tom581]

I updated the ‘hosts’ file as per an earlier post and have not had this since. Perhaps that’s the ‘real’ solution. For me, before, this issue would come and go for no apparent reason I could discern. It’s peace for now.