Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: fhurst on February 07, 2011, 03:34:25 PM
-
I have had a few HTML-Iframe-inf aborts in the past, but today on a Google search page at < http://www.google.com/search?q=Lidia+Bastianich+Beef+Chuck+Braised+in+Beer%2C+Whole+Grain+Spaetzle&ie=UTF-8 > almost every page was aborted. This can't be right!
What is happening? They can't all be infected can they.
-
Now I know something is wrong. I went back to a page that I had already visited successfully, on another Google search page, which was still running in another tab in Firefox, and avast aborted it too.
-
You are running a rather old version of avast!, so it is probably worthwhile to upgrade to the latest release 5.1.889. By abort, do you mean from Webshield? Have you done a reboot? Sounds like something has crashed.
-
You are running a rather old version of avast!, so it is probably worthwhile to upgrade to the latest release 5.1.889. By abort, do you mean from Webshield? Have you done a reboot? Sounds like something has crashed.
Sorry I should have told you, but I am running 5.1.889, on the Dell.
Yes, Web Shield is responsible for these Aborts.
I cleared my cache and restarted Firefox, but did not reboot my system.
I rebooted my system, allowed the pages to reload in Firefox, and it is still aborting almost every page on that search. They are all different websites, so I feel avast somehow screwed up with it's last update.
-
I exited that search page, cleared the cache, re-entered the same search subject. The first 8 loaded, but < pc-adapter.net/reachel/lidia-bastianich-beer-braised-beef.html and dalinah.com/portos/lidias-braised-beef-with-beer-recipe.html > were aborted and then on the next page the following pages were aborted < kempobond.nl/newbu/lidia-braised-beef-liguria.html and test.flintthompson.com/storyov/beer-braised-beef---lidia.html and dot.dobsonarts.com/figurezm/lydia-beer-braised-beef.html?ao=0 and gatewoodwitte.com/careve/lidias-braised-beef-with-beer-recipe.html and doubleeaglehorsefarm.com/starttb/lidia-braised-beef-liguria.html and siamview.net/singzl/braising-beef-with-beer-lidias-italy.html?ao=0 >. That is 6 out of 10 on that page.
-
Interesting results. With FF and IE I am also getting the aborts; no problems with Opera which I was using before or with Chrome. Which version of FF are you using? I'll send this thread to support and see if they have any feedback.
UPDATE: BTW, what database version are you running in Avast!? I have 110207-0 .
-
Interesting results. With FF and IE I am also getting the aborts; no problems with Opera which I was using before or with Chrome. Which version of FF are you using? I'll send this thread to support and see if they have any feedback.
UPDATE: BTW, what database version are you running in Avast!? I have 110207-0 .
I'm using FF v3.6.13. The avast database is the same as yours v110207-0 .
-
I get another interesting observation with these sites. Tried turning off Webshield, and then the Avast! Network Shield aborts it in FF. So Avast! appears to be getting different results based on the page rendering by the browser. Shouldn't happen; bug of some sort-maybe in the database update?
Did send the thread to support; hope someone from Avast! looks at it soon.
-
I clicked on some of the websites listed in the Google search link above. I tried it both in FF 4b10 and IE9 Beta.
The results lead me to believe that there could be redirect or hijacking going on here with these websites so they are being blocked by AIS
-
Same here - it is indicating a redirect to a set up file
-
Same here - it is indicating a redirect to a set up file
Until this is resolved, as far as I'm concerned, I'll trust avast and leave these sites alone. I'll wait a few days and see if the site managers are able to fend off the offenders.
-
Avast! still needs to take a look at it though, since they don't see the problem in two of the browsers. Or did anyone manage to get a response using Opera or Chrome? If malware can bypass Avast! based on browser choice, this is a serious problem. Looking at the pages with Opera or Chrome rings no alarms of any kind, just brings up the page.
-
Avast! blocks that Google search with both IE9 and Firefox 3.6.13 for me, with Opera 11.01 however there is no reaction at all.
-
BTW, I believe these are FPs but have no way of verifying it. If you look at my signature, I also run Prevx with SafeOnline and Online Armor with Emsisoft antivirus and they did not react at all when I went to the sites with Opera and looked around. Always possible I didn't try to access the right objects, but malicious websites are usually a bit more aggressive than that.
-
Most of the links on that Google Search page got redirected to the first URL/link when I tried it.
-
Hello,
it does not look like false positive - i tried some of the sites from the top of the results and they are redirecting to some FakeAV sites.
Alena Varkockova
-
Have you looked to see why Opera and Chrome don't see a problem at all? It is either FPs in IE and FF or FNs in Opera and Chrome. Or do the other shields eventually catch it there also?
-
Latest Report:
1. Heard from Avast! support. They sent me a form letter saying to go back to 5.0.677 until they fix the problem, so don't seem to be an avenue to look into it further.
2. Went to the first search item with Opera, no popups from Avast!, tried all the links, found nothing malicious.
3. FF blocks it with Webshield, if you turn off webshield blocks it with network shield. I'll let Avast! turn off network shield and see why there is such a significant difference between the browsers.
SO, is the conclusion that we should all use Opera or Chrome? ::) Thank you Alenka for looking into it. :)
-
Latest Report:
1. Heard from Avast! support. They sent me a form letter saying to go back to 5.0.677 until they fix the problem, so don't seem to be an avenue to look into it further.
2. Went to the first search item with Opera, no popups from Avast!, tried all the links, found nothing malicious.
3. FF blocks it with Webshield, if you turn off webshield blocks it with network shield. I'll let Avast! turn off network shield and see why there is such a significant difference between the browsers.
SO, is the conclusion that we should all use Opera or Chrome? ::) Thank you Alenka for looking into it. :)
Who has an installer for v5.0.677?
-
Saw an announcement on Comodo Site Inspector, which scans sites for malware, so ran the first of the urls on the search through it. Reported as safe, for what that is worth. ??? BTW, the "go to .677" looks like a stock answer, not an indication that the problem doesn't occur there.
-
Try testing the links at URLVoid, currently that seems to be working better than Comodo SiteInspector, but I do use that one too. ;)
I hope they fix your problem soon.
Good luck,
-John Jr :)
-
Saw an announcement on Comodo Site Inspector, which scans sites for malware, so ran the first of the urls on the search through it. Reported as safe, for what that is worth. ??? BTW, the "go to .677" looks like a stock answer, not an indication that the problem doesn't occur there.
un-installed 5.1.889, rebooted used the avast un-install utility, rebooted cleaned registry, rebooted twice, installed .677 rebooted twice. checked those sites again - same problem. Checked sites with URLVoid and they tested OK. ?????????
-
Saw an announcement on Comodo Site Inspector, which scans sites for malware, so ran the first of the urls on the search through it. Reported as safe, for what that is worth. ??? BTW, the "go to .677" looks like a stock answer, not an indication that the problem doesn't occur there.
un-installed 5.1.889, rebooted used the avast un-install utility, rebooted cleaned registry, rebooted twice, installed .677 rebooted twice. checked those sites again - same problem. Checked sites with URLVoid and they tested OK. ?????????
I was too lazy to go back and read from the beginning of the post at this time, so I may accidentally repeat something that was already mentioned, if that happens; I would like to apologize in advance. :D
Anyway, you definitely need some help Boss, and I will try to see what I can do for you. :)
Have you ever switched your DNS service and/or Host File?
If not, how about a little experiment, try downloading the ClearCloud DNS utility and enable ClearCloud DNS and see what happens.
Also if you have not done so already make sure Windows is up-to-date, run CCleaner, try running IE/Chrome/Firefox in InPrivate/Incognito/Private Mode, see what add-ons/plug-ins are set to run.
Also try clearing All data from the browser options of each browser, if you have not done so, which I think you already have. ;)
Download Emsisoft HiJackFree and save the log & post it here, and maybe we can see if anything suspicious shows up in it.
Also you may want to also download Comodo KillSwitch and save the log from that & post it here as well, but it is Beta and you may have to log into the forum to download it; so do not worry about it if that is the case, since HiJackFree's log will probably have almost all we need.
Also download and install Secunia PSI and/or FileHippo Updater (I use both) and scan to see if it/they show any of your programs as being out-of-date.
Try running a Avast Boot Scan on Highest Detection Setting (Thorough) and set to scan All Local Drives, if you have not done so already, and maybe even setting most of your Avast settings on High such as: Scan Whole File, Scan For Potentially Unwanted Files, uncheck this one setting for persistent cache of safe files to never be scanned again even after rebooting, etc.
Heck even try a full Malwarebytes scan, Windows Defender (hahaha), Norton Power Eraser, Hitman Pro.
Hmmm, I wonder could some malware had changed your Host file?
Also what if some Flash Cookies or something are the problem!?
Try going to the Adobe Flash Player Global Settings Manager and setting it to store None in several of the categories where you have that option and delete any entries that have been saved and/or use the Better Privacy Firefox plug-in and set it to automatically delete them on the close/exit of the browser without asking, delete flash player default cookie, and empty cookies folder.
We are going to fix this Boss, let me know what happens, we will win this battle! ;D
For BigBro! *Dramatic Battle Music* ;D
-
@goodjohnjr
If you do get around to reading the earlier posts, this is a problem that is repeatable for multiple users, and only occurs with IE and FF, not with Opera or Chrome. Something in the site rendering differences or ??? Have you tried it with multiple browsers and had different results? Seems to be something Avast! really needs to wade in on. Other ideas?
-
@goodjohnjr
If you do get around to reading the earlier posts, this is a problem that is repeatable for multiple users, and only occurs with IE and FF, not with Opera or Chrome. Something in the site rendering differences or ??? Have you tried it with multiple browsers and had different results? Seems to be something Avast! really needs to wade in on. Other ideas?
Okay Boss, I finally got my lazy butt to read/glance over this post from the beginning again, and I have to ask (to clarify for my poor brain since sometimes the English language gives me a hard time, though it is the only language I know ;D ); did yall try un-installing Avast and then install the newest version or did you just repair or update the installation and did you set it to save your user preferences or not?
I believe one or more of you are currently using an older version as suggested by the Avast team correct?
It could be an Avast problem and/or could something else, I am not using Avast at this time to test it myself unfortunately, I test out different programs from time to time. ;)
I would try that and maybe some of my suggestions as experiments, I am curious if any of them will help us troubleshoot the problem or at least rule out what is not the problem. ;)
Good luck Boss,
-John Jr :)
-
@goodjohnjr
If you do get around to reading the earlier posts, this is a problem that is repeatable for multiple users, and only occurs with IE and FF, not with Opera or Chrome. Something in the site rendering differences or ??? Have you tried it with multiple browsers and had different results? Seems to be something Avast! really needs to wade in on. Other ideas?
Okay Boss, I finally got my lazy butt to read/glance over this post from the beginning again, and I have to ask (to clarify for my poor brain since sometimes the English language gives me a hard time, though it is the only language I know ;D ); did yall try un-installing Avast and then install the newest version or did you just repair or update the installation and did you set it to save your user preferences or not?
< Reply: I did both. At first I upgraded. That's when I thought this first began. I then un-installed avast using Revo Uninstaller, to clean up orphan files, then used the avast un-install utility, then CCleaner, all with multiple reboots between. I then re-installed avasts latest, but problem persisted. I then un-installed again and switched to the older version as per avast's instructions and the problem still persisted, so when it offered to upgrade I let it do it's thing. >
I believe one or more of you are currently using an older version as suggested by the Avast team correct?
< Reply: I was up to date to start with, but had not updated my personal info on this site, so the feller who originally replied thought it was out of date. >
It could be an Avast problem and/or could something else, I am not using Avast at this time to test it myself unfortunately, I test out different programs from time to time. ;)
I would try that and maybe some of my suggestions as experiments, I am curious if any of them will help us troubleshoot the problem or at least rule out what is not the problem. ;)
< I believe I need to check my Host file, seems like I remember something about one of my apps guarding it or something. I think Spybot Search and Destroy. I'll get back after looking. >
Good luck Boss,
-John Jr :)
-
I checked Spybot Search & Destroy and there is a section called Immunize. I suppose the thing to do is to click on "Undo" and see if that helps.
-
I checked Spybot Search & Destroy and there is a section called Immunize. I suppose the thing to do is to click on "Undo" and see if that helps.
Good, try that. :)
Also I never messed with my Hosts file before but I found a website that mentions how to delete the Hosts file and download the default Windows Hosts File again and add it back and also how to remove the MVPS Hosts file if you had it installed which you do not so you do not have to worry about that probably. (I never done this myself, so be careful, read, and get an Expert opinion if needed. ;)
I found it under the Uninstall section of the MVPS Host File site. (Which is a popular Hosts File that some people use for filtering & AD blocking/etc:
http://www.mvps.org/winhelp2002/uninstall.htm
I think it says the Hosts file is normally found at (You may have to set your properties to show Hidden Files):
Windows 7/Vista/XP = C:\WINDOWS\SYSTEM32\DRIVERS\ETC
Windows 2K = C:\WINNT\SYSTEM32\DRIVERS\ETC
After finding the Hosts file you can delete it and/or paste the new one in that folder and over-write the old one.
The Windows Vista/XP Hosts file can be downloaded at:
http://www.mvps.org/winhelp2002/DefaultHosts.zip
The Windows 7 Hosts file can be downloaded at:
http://www.mvps.org/winhelp2002/defaultwin7-hosts.zip
You will paste the Hosts file for your Operating System from the ZIP to one of the folders listed above.
But they had the directions and you will probably even find some YouTube videos explaining it.
Anyway, good luck with whatever you decide to do or not do. ;)
I am sure we will figure out the problem eventually. :)
-
I checked Spybot Search & Destroy and there is a section called Immunize. I suppose the thing to do is to click on "Undo" and see if that helps.
Nope, that didn't help either.
-
I checked Spybot Search & Destroy and there is a section called Immunize. I suppose the thing to do is to click on "Undo" and see if that helps.
Nope, that didn't help either.
Installing the default host file did not help either.
-
I checked Spybot Search & Destroy and there is a section called Immunize. I suppose the thing to do is to click on "Undo" and see if that helps.
Nope, that didn't help either.
Installing the default host file did not help either.
Ouch!
1. What about trying a different DNS service like ClearCloud DNS and see what happens?
http://clearclouddns.com/
2. Did Malwarebytes Free or Hitman Pro Free or Norton Power Eraser Free find anything?
http://www.malwarebytes.org/mbam.php
http://www.surfright.nl/en/hitmanpro/
http://security.symantec.com/nbrt/npe.asp?lcid=1033
3. Did an Avast Boot Scan set to Scan All Local Drives and set to for a Thorough scan find anything?
4. How about you download Emsisoft HiJackFree and save a copy of the Log/Report here so we can see what processes, startup entries, etc are there in case some malware are something can be found in there by some Experts here?
http://download3.emsisoft.com/a2HiJackFree.exe
5. Did you try running your browsers in Incognito/Private/InPrivate Mode to see what happens?
6. What Extensions/Add-ons are you using?
7. Did you try going to your Adobe Flash Player Global Settings Manager and Clear/Delete any stored websites/flash cookies/etc in each category?
http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager03.html
8. Did you try downloading Secunia PSI and scanning your system to make sure that your most of your software is up-to-date and have most of your vulnerabilities patched?
http://secunia.com/vulnerability_scanning/personal/
9. Did you e-mail/contact the Webmasters of those websites to see if they can see if they find anything unusual?
10. What firewall or firewalls are you using?
11. Is your Operating System up-to-date?
12. Are you using a Wireless or a Wired Internet Connection?
13. If you are using a Wireless Internet Connection, are you using Encryption and a Password?
14. Are you using a Router?
15. Is your Flash Player & Shockwave Player & Java & Silverlight up-to-date?
http://www.adobe.com/go/getflashplayer
http://www.adobe.com/go/getshockwave
http://java.com/en/
http://www.silverlight.net/getstarted/
???
We will figure this out eventually, hopefully. :D
For Avast!!! :D
-
tried a couple of the original urls and it gets blocked on IE
-
Same here - it is indicating a redirect to a set up file
You got pirate talk lang ? ;D
-
I would suggest uninstalling spybot and see what happen's then, there has been a few issue with it lately not getting along with avast.