I keep getting an Avast pop–up that says:
“Malicious URL Blocked.”
It then shows the alleged URL that was blocked and states:
Infection: URL:Mal
Process: C:\Windows\system32\svchost.exe
Can someone help me?
I’m pretty sure Avast is just being strange, because my computer seems to be running pretty perfect. And other scans are showing nothing.
Let me look over your logs and I will return as quickly as I can. I have some things going on this morning so it may be a little bit before I can get back. Thanks for your patience.
Download CKScanner by askey127 from Here & save it to your Desktop.
[*] Right-click and Run as Administrator CKScanner.exe then click Search For Files
[*] When the cursor hourglass disappears, click Save List To File
[*] A message box will verify the file saved
[*] Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
Thank you very much for the help. Seems as if Avast! was not just acting up. Whenever I turn my computer on, it is just a white screen with 5 or 6 processes running,
I’m doing this from safe mode now.
CKScanner - Additional Security Risks - These are not necessarily bad
c:\program files (x86)\steam\steamapps\common\magic the gathering tactics\export_win32\resources\particles\cha_fidget_colossus_crack.tga
c:\program files (x86)\steam\steamapps\common\magic the gathering tactics\export_win32\resources\particles\eff_animals_crackedearth.tga
c:\program files (x86)\steam\steamapps\common\magic the gathering tactics\export_win32\resources\pssg\props\plains_manadevicecracked.pssg.gz
scanner sequence 3.CP.11.GUAPSV
----- EOF -----
Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
Run OTL.exe
[*]Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot when it is done
[*]Then run a new scan and post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )
Hey,
I should probably mention that I re-scanned my computer using Avast on safemode earlier this evening and found 4 infected files.
I deleted the files and have since then been able to run my computer pretty well outside of safemode (no white screen anymore.)
The original “Malicious URL Blocked” Avast alert has also not happened since then. However, I am not sure if I am in the clear yet…
I ran the program just the other day to provide the logs that are already up, so I am not sure what could be going on.
I tried deleting the program and re-downloading, but that didn’t help.
It could help if you reported the file names and locations of the avast detections that you deleted ?
Deletion isn’t really a good first option (you have none left), ‘first do no harm’ don’t delete, send virus to the chest (a protected area) and investigate.
I didn’t think to write down the information on the viruses it detected
I tried sending all four of them to the chest at first, but two of them were not cooperating and would not go into the chest, so I deleted the files.
I’m not sure if I can retrieve the information about the files I had deleted, but the two files in my chest have the following descriptions:
Yes please do not delete or run anything else without being asked. There are infections that will render your system a fancy paperweight if you remove it improperly.
Download Combofix from either of the links below, and save it to your desktop. Link 1 Link 2
Note: It is important that it is saved directly to your desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
When finished, it will produce a report for you.
[*]Please post the C:\ComboFix.txt for further review.
The files at 1 & 2 certainly look suspect, based on their file names whilst the c:\windows\installer\ folder is commonly used, it is also seen being used by malware. Given that and the Malware name the detections look good and are safely locked away in the chest for now.
If the other two detections were along the same lines, e.g. strange file name and also in the c:\windows\installer\ folder, it is possible that they were/are related to these other two detections.
That’s me for the night, almost 2:50am here, hopefully jeffce can continue.
I’m not sure what scan that you did from safe mode or even if scans from safe mode are recorded in the same way as scans run from normal mode. You can check the avastUI, Scan Computer, Scan Logs and see if the scan that you ran is listed there, if so that should have the information on the detections.
alright thanks.
