Good evening!
I was running a converter program when I got a warning from Avast!
MALICIOUS URL BLOCKED
…
Object: 68.178.232.99/crs/crs.php
Infection: URL:Mal
Action: Blocked
Process: C:\Program Files\Tall Emu\Online Armor\oaui.exe
I think it’s a false positive - I didn’t get warnings like this since the last update.
I can’t attach the screenshot because it’s too big.
Thank you very much!
Something wants to connect to URL that is malicious (?). Or just a FP from avast!
BTW You can convert image to .jpg format (which is not that big) or just load picture on any of the servers (imageshack.us, …)
It did when you started that program?
I took a look at the site with and without Network Shield on. Network Shield gives the popup attached. Without it, I just get a message that the site is not currently available (I have Prevx SafeOnline also watching the site; no reaction). So could be:
a. An Avast! incorrect IP blacklist-Avast! check
b. An IP that has become malware related since the older OA version here used it-OA upgrade should fix that
c. Older OAUI.exe has been taken over, so check digital signature
d. Other virus, so run an Avast! boot time scan
There have been no reports of recent OA versions having this problem. Current version is 5.0.0.1067.
I’m wondering what OA is doing connecting to this IP address if you were just running a converter program, there shouldn’t be any need to connect. Interestingly for that IP address, MBAM Pro would also block it. So I have no idea why OA UI would be trying to connect to it.
So I suspect this alert on your system or rather OA is unrelated to the actual converter program.
When posting screenshots a) crop them to only show what is relevant and b) use the .gif file format which is generally a smaller file size.
I don’t have any problems now - I installed the latest Online Armor (Free) version - which is 4.5 as I saw on the website.
There was a malicious DLL in my System32 called madchook.dll - MadCodeHook - detected by Malwarebytes’ Anti-Malware, I removed it.
I hope we can mark this topic as solved 
Thank you very much for helping!
I attached the screenshot!
Whilst in this case the madchook.dll is associated to malware but some also say it is installed by some legit programs, what for I haven’t the slightest idea. http://www.processlibrary.com/directory/files/madchook/409002/
It even if legit appears to be a non-essential file.
At the very least you should confirm the detection:
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here, post the URL in the Address bar of the VT results page. You can’t do this with the file securely in the MBAM quarantine, you need to extract it unfortunately MBAM restores it to the original location.
If multiple scanners detect this then this sample should also be sent to avast, before allowing MBAM deal with it again.
Send the sample/s to avast as a Undetected Malware:
Open the chest and right click in the Chest and select Add, navigate to where you have the sample and add it to the chest (see image). Once in the chest, right click on the file and select ‘Submit to virus lab…’ complete the form and submit, the file will be uploaded during the next update.
Or
Send the sample to virus (at) avast (dot) com zipped and password protected with the password in email body, a link to this topic might help and false positive/undetected malware in the subject.