hxxp://lwdetyqhzh.ru/adbstyles.js?u=98022 Pop up

[system]

Hi I’m looking for some help.
Every time I open up a new webpage avast tells me a threat has been detected with this message - hxxp://lwdetyqhzh.ru/adbstyles.js?u=98022

I have attached my logs and hope that someone can help me with this problem.

Thanks.

[system]

Got exact same problem and its pissing me off now >:(
Please help!

[mchain]

@ilija_alexandrovitsj post:2

Got exact same problem and its pissing me off now >:(
Please help!

Hi ilija_alexandrovitsj,

And welcome to the forums.

Please start your own new topic.

Notwithstanding the fact that the issue/symptoms are the same, your system is set up and configured differently than the original poster, so any fixes/repairs are going to be different and crafted specifically for your system and no other. Once that is done, following the above advice in this topic: https://forum.avast.com/index.php?topic=53253.0 a malware expert will be contacted for you. You can post a link here to that new topic if you wish, to help speed things along.

Help will be forthcoming once your logs are attached in your own new topic.

[system]

This is likely caused by the Acestream plugin “AS Magic Player.” It may also be called “TS Magic Player” if you’re using an older version. You can check if this is the issue by disabling the extension and restarting your browser.

Acestream is cool software, but I had heard for some time that it tries to give you malware. As of yesterday I started getting that popup, so it does appear to be the case.

[system]

@sephmccarty post:4

This is likely caused by the Acestream plugin “AS Magic Player.” It may also be called “TS Magic Player” if you’re using an older version. You can check if this is the issue by disabling the extension and restarting your browser.

Acestream is cool software, but I had heard for some time that it tries to give you malware. As of yesterday I started getting that popup, so it does appear to be the case.

Yep, that did the trick! Thanks so much for your help, it was driving me nuts!

[system]

You’re welcome. I ran the url lwdetyqhzh.ru/adbstyles.js?u=98022 through the URL scanner at VirusTotal and it came up clean on 58/59 tests. It might be a false positive but I’m not feeling great about AS reaching out to some random .ru domain every time I open a website so I’m keeping it disabled for now. I’d report it to avast but I only see a way to do that with files…?

[system]

@sephmccarty post:4

This is likely caused by the Acestream plugin “AS Magic Player.” It may also be called “TS Magic Player” if you’re using an older version. You can check if this is the issue by disabling the extension and restarting your browser.

Acestream is cool software, but I had heard for some time that it tries to give you malware. As of yesterday I started getting that popup, so it does appear to be the case.

Hi Sephmccarty; thanks from me as well; AS Magic Player removed and the warnings all disappeared.

[essexboy]

@kevinroche8 do you still require assistance

[Milos]

Hello,
does this URL block appear in all browsers? It can be some plugin in browser.

Milos

[essexboy]

It is a FF/Chrome extension a media plug in with a few different names