Avast WEBforum

Other => Viruses and worms => Topic started by: AlanC on July 01, 2013, 11:26:34 AM

Title: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: AlanC on July 01, 2013, 11:26:34 AM
I'm using the free avast, and for the past few days avast is virtually continuously telling me that it's blocking url   http://urlfilter.vmn.net/vmnsbf/data/130...

From a quick search on google it appears this is an infected url. How do I solve this problem?

Thanks,

Alan
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: Asyn on July 01, 2013, 12:14:34 PM
Please attach your logs. (AdwCleaner, MBAM, OTL and aswMBR..!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: AlanC on July 01, 2013, 05:37:05 PM
I've followed the instructions and attach the logs. The OTL scan only opened one Notepad window, there wasn't one for Extras.txt.

What happens now?

Thanks,

Alan
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: Asyn on July 01, 2013, 05:41:17 PM
What happens now?

Now you've to wait a bit.
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: magna86 on July 01, 2013, 06:14:31 PM
I'm on it ...
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: magna86 on July 01, 2013, 06:23:57 PM
@AlanC,
Welcome to avast. I will be working on your Malware issues.



Download TDSSKiller (http://media.kaspersky.com/utilities/VirusUtilities/EN/tdsskiller.exe)  and save it to your desktop

    Execute TDSSKiller.exe by doubleclicking on it.

Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt


Please post the contents of that log in your next reply.
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: polonus on July 01, 2013, 07:03:58 PM
Avast was blocking because it was finding HTML:Iframe-inf there aka HTML:Iframe-inf
see: http://support.clean-mx.de/clean-mx/viruses.php?descr=NationalNet,%20Inc.%20NATL%201130%20Powers%20Ferry%20Place,%20SE%20Marietta%20GA%2030067&sort=first%20desc&response=alive

polonus
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: AlanC on July 01, 2013, 07:31:31 PM
Thanks for your help! Attached is the log from the TDSSKiller scan.

Thanks,

Alan
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: magna86 on July 01, 2013, 08:17:02 PM
@AlanC
I don't see active malware on your system. You may remove your tool by re-runing OTL and clicking on CleanUp! button.
If you wish, we can run additional checking but I would say that there is no need for that.
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: denics on July 01, 2013, 09:21:10 PM
Guys,
this issue is caused by Antiphishing Domain Advisor. The program downloads unencrypted list of malicious urls and avast! detects the urls therefore the list gets blocked. This issue is not fixable on our side. Uninstalling Antiphishing Domain Advisor will solve this.
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: AlanC on July 01, 2013, 09:46:18 PM
Thanks guys! Don't know whether it's coincidence or not, but avast hasn't blocked anything since I downloaded and ran the various programmes.

I'll follow your suggestion on re-running OTL Magna.

I don't see Antiphishing Domain Adviser anywhere denics - would this show on my list of programmes if it was installed?
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: magna86 on July 01, 2013, 10:49:33 PM
Thank you denics for tip & jump in.  :)

@AlanC
Nothing was done except that AdwCleaner has been cleand up your computer from bunch of varius garbage.
Quote
I don't see Antiphishing Domain Adviser anywhere denics - would this show on my list of programmes if it was installed?
AdwCleaner has been detect & remove Anti-phishing Domain Advisor.  :)
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: denics on July 02, 2013, 08:22:25 AM
Thanks guys! Don't know whether it's coincidence or not, but avast hasn't blocked anything since I downloaded and ran the various programmes.

I'll follow your suggestion on re-running OTL Magna.

I don't see Antiphishing Domain Adviser anywhere denics - would this show on my list of programmes if it was installed?

Probably yes.. most of the times this issue is caused by Antiphishing Domain Advisor, but it might just happen that some other program is using the same database for updates, so you should look for any programs that could use it.
Title: Re: Malicious URL http://urlfilter.vmn.net/vmnsbf/data/130...
Post by: Pondus on July 02, 2013, 09:25:15 AM
Quote
I don't see Antiphishing Domain Adviser anywhere denics - would this show on my list of programmes if it was installed?
from AdwCleaner log.  :)

Quote
Folder Deleted : C:\ProgramData\Anti-phishing Domain Advisor
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Anti-phishing Domain Advisor
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Anti-phishing Domain Advisor]



Anti-phising Domain Advisor problem has been posted here many times before.... so you find more info if you do a forum search

here is one. http://forum.avast.com/index.php?topic=119552.msg919179#msg919179