AvastUI.exe

[TruAnRksT]

This seems like strange behavior but when I booted my PC this morning, before Avast could auto update I got about half a dozen warnings in a row citing something called hxtp://www.thebargainmob.com with the infected file listed as AvastUI.exe

A full scan with MalwareBytes came up clean so I did a repair on Avast and am currently running an Avast full scan with all options enabled.

Has anyone else seen this behavior and is it possible the Avast installation has been compromised? I'm concerned that if Avast has been compromised even in a small way then can it still be trusted.


Oh I should have mentioned I am running Win 7 Ultimate in 64 bit mode and using Avast free edition.

Or perhaps I'm just reading the warning window incorrectly.

[Pondus]

please edit the link above and make it unclickable, as it is infected

thebargainmob.com  - sucuri scan  http://sitecheck.sucuri.net/results/www.thebargainmob.com/

McAfee  http://www.siteadvisor.com/sites/thebargainmob.com

[TruAnRksT]

Ah sorry about that, I see the issue has been taken care of for me.

The information is interesting, I was pretty sure bargainmob would be a bad site.
Never heard of it before. But what about Avast seemingly faulting it's own file?

The scan is 81% with one detection so far, but I'll have to wait for completion before it will tell me what file was detected.

[DavidR]

It isn't an infected file as such but supposedly the process responsible for initiating the connection.

That said it is somewhat strange, are you sure it was avastUI.exe and not avastSvc.exe as this controls the web shield and its localhost proxy ?

The avastUI shouldn't be involved in this as it is the user interface and not part of the scanning shields.

[gibot]

I am curious as how you got infected when you booted your pc.

[TruAnRksT]

I'm not even sure it was a real infection, but I would have to assume it was picked up last night before shutting down and attempted to assert itself during boot.

Yes it was AvastUI.exe that was listed at the bottom of the warning box.

It was detected several times in a row in short order. But I haven't seen any other unusual behavior yet. That site is going in my hosts file though.

Scan is 96% still only one detection.

[TruAnRksT]

Well the one file turned out to be nothing of any importance. So with all scans completed I can only conclude that whatever the problem originally was Avast took care of it. Just have to keep an eye on things I suppose.