Script:SNH-gen (Adw)

Viruses and worms
1

Hi,

Every 15 minutes or so, whatever website i visit on Google Chrome, i keep getting a notification from avast with the message: Threat negated → Script:SNH-gen (Adw).
It has to do with the webshield.
I already scanned my PC twice. What is the problem? How do i get rid of this?

Thanks in advance!

2

Can you attach a screenshot (see attached image for how) of the alert window with the More Details section opened also.

Have you installed any new browser extensions or had some updated ?

3

Hi,

I was getting the same issue, i removed unused extensions and reinstalled chrome. It has helped resolve the issue so far…

4

Hi,

In the attachment is a screenshot for more details. Thanks for helping.

5

More to flag → https://www.virustotal.com/gui/url/cf29991de6b653161eed79ff70a48830775e8d6ffb6f627cb7bc75acce5f1d8b/detection
Report to: {“group”:“cf-nel”,“endpoints”:[{“url”:“https://a.nel.cloudflare.com/report?s=Zyiia816nDW9L040YEZWymUuoGcBJNBisii%2FIaeLPPIzk3Gat%2B8ySgEOhJZj7%2BY37IvLAVekd24fMnReQ3eHwkIsObaG8ftD23jH8w%3D%3D”}],“max_age”:604800}

Additional scanning with MBAM could be advised. Wait for a final verdict from avast team for this generic find.

See related detections here: https://www.virustotal.com/gui/domain/a.nel.cloudflare.com/relations

polonus

6

OK, if you weren’t intending to visit the URL (areasrc.net) in the more details section, then it is either a redirect from another site, which I think is less likely or the URL should have been that primary site. Or something in your browser (possible rogue extension) is trying to connect to it.

I tried to check the site out but effectively kept getting a 403 Forbidden error
Though one scan of the site found it to be a Medium Security Risk - https://sitecheck.sucuri.net/results/areasrc.net
Another shows security weaknesses - https://webhint.io/scanner/7ea34fc1-39e8-4952-8586-517208af5742

All I can suggest:

  1. Try running Chrome with extensions disabled - give it some time and see if it happens as before.
  2. If not then the likelihood is it is a rogue extension trying to connect to this site to run that .js (javascript) file.
  3. Try what SamuelWatson89 did in the post above yours.

Outside of that I’m at a loss as I don’t, nor ever have run Chrome, so I’m not sure of its inner workings.

7

Just reinstalled chrome+ disabled all extensions. i’ll let you know if something happens again. Thank you for the help so far!

8

You’re welcome.