Avast WEBforum

Consumer Products => Avast Mac Security => Topic started by: REDACTED on March 21, 2017, 08:28:27 AM

Title: INFECTION BLOCKED
Post by: REDACTED on March 21, 2017, 08:28:27 AM
An Avast box just appeared in the upper right corner of my computer.  Immediately another one followed.  I opened Grab and took a pic of it so I would have a copy in case it faded away.  As soon as I got the pic 2 more boxes appeared.  I took another pic and immediately 2 more appeared.  As soon as I got a pic of the 6, another one appeared.  Now I had 7 boxes all saying they had blocked an infection.  They each said: Infection:  URL: Mal.  Then a URL was listed; of the 7 boxes there were 2 URLs.   Beneath that was Process: /Applications/Firefox.app/Contents/MadOS/firefox. 

Should I click on the URLs or just do nothing as the threat was blocked?  I switched my browser to Chrome. 
Thanks.
Title: Re: INFECTION BLOCKED
Post by: Milos on March 21, 2017, 02:17:49 PM
Hello,
post the screenshot of the avast's alert, please.

Milos
Title: Re: INFECTION BLOCKED
Post by: REDACTED on March 21, 2017, 05:11:53 PM
I developed a similar but possibly different problem yesterday where the red "Infection Blocked" "Avast Email shield has blocked a threat" continually popup several of the same notifications. Even after clicking the notifications to get rid of them, the same notifications will just popup again in a few minutes, so basically I can't get rid of them(taking up a large part of my screen), and I have tried dozens of times. I cannot seem to find these emails by searching for them in the OSX Mail app. I am on Sierra 10.12.3. These  messages dont appear to be new as I don't see them on my other machines or iphone email, which have no email filtering or protection.

I just installed avast last week on this particular MacBook, and have about 40K emails in Mail.

Image url below.
https://postimg.org/image/c61x2l0oh/
Title: Re: INFECTION BLOCKED
Post by: Pondus on March 21, 2017, 08:03:15 PM
I developed a similar but possibly different problem yesterday where the red "Infection Blocked" "Avast Email shield has blocked a threat" continually popup several of the same notifications. Even after clicking the notifications to get rid of them, the same notifications will just popup again in a few minutes, so basically I can't get rid of them(taking up a large part of my screen), and I have tried dozens of times. I cannot seem to find these emails by searching for them in the OSX Mail app. I am on Sierra 10.12.3. These  messages dont appear to be new as I don't see them on my other machines or iphone email, which have no email filtering or protection.

I just installed avast last week on this particular MacBook, and have about 40K emails in Mail.

Image url below.
https://postimg.org/image/c61x2l0oh/
Try access your mail account from webmail and delete the mails there


Title: Re: INFECTION BLOCKED
Post by: REDACTED on March 21, 2017, 09:11:03 PM
Hello,
post the screenshot of the avast's alert, please.

Milos

Milos, I don't know how to do that, but the images that Kelly posted are the same as they say they blocked a threat, and the Process is the same.  The central part of the alert is different.
Title: Re: INFECTION BLOCKED
Post by: Pondus on March 21, 2017, 10:47:14 PM
Kelly has infected mail detection, you have blacklisted url blocking (URL:Mal)


Search Google or YouTube for how to take a screenshot

Title: Re: INFECTION BLOCKED
Post by: REDACTED on March 22, 2017, 01:54:10 AM
I had the same (?) issue last night. Popups over and over again but it wasn't related to any one website. I did not have the Play Store open at the time and it seemed to recur when I did a search from the search bar. It happened in Chrome, Firefox, and Safari.

(http://imgur.com/MefjfFt.png)
(http://imgur.com/6JjBB7a.png)

I deleted Firefox and Chrome as well as related files in Application Support. The popups stopped in Chrome and Firefox but continued in Safari for a while. They all stopped at a seemingly random time when I was away from the computer for a moment.

After reinstalling Firefox, I get this error. I do not get this in Chrome or Safari. I'm not sure if they are less secure or if the Web Shield isn't running in those any longer or what.

(http://imgur.com/UpdesI4.png)

Here are the details.

(http://imgur.com/ZD2l96j.png)

I downloaded MalwareBytes Anti-Malware and the scan came up clean. I followed all of the steps that applied to me on this page. The only thing I didn't do is try a new network since that wasn't practical last night. Now the popups have stopped so I don't know if that would tell me anything.
https://support.malwarebytes.com/customer/portal/articles/2045704-what-should-i-do-if-malwarebytes-anti-malware-for-mac-didn-t-solve-my-problem-?b_id=9511 (https://support.malwarebytes.com/customer/portal/articles/2045704-what-should-i-do-if-malwarebytes-anti-malware-for-mac-didn-t-solve-my-problem-?b_id=9511)

I ran a scan on Avast, which found two infections in old install files. I deleted those but the popups stopped before I deleted these files.

(http://imgur.com/NuQ0e5G.png)

I also scanned the network, which appears OK and my roommate doesn't seem to be having a problem.

I searched for "blacklisted url blocking (URL:Mal)" but I don't think that quite applies (but I could be wrong -- I'm not a security expert). So now my questions are:

1) How do I make Firefox usable?
2) Am I safe using Safari and Chrome in the meantime?
3) What the hell happened last night and are there further steps I need to take to make sure I am safe?
Title: Re: INFECTION BLOCKED
Post by: Milos on March 22, 2017, 10:08:38 AM
Hello,
without knowing which URL was blocked (URL:Mal) we can't help. So please attach screenshot of the detection, please.

Milos
Title: Re: INFECTION BLOCKED
Post by: REDACTED on March 22, 2017, 03:34:46 PM
Updated the links to the images on my post.
Title: Re: INFECTION BLOCKED
Post by: Milos on March 22, 2017, 03:59:26 PM
Hello
this was a false positive and is already fixed. This looks that avast does not load new stream update or even new VPS which were already released (this can happen when avast is still scanning and hold the old VPS and the new one cannot be loaded). Restart of the avast's service should reload the new VPS.

Milos
Title: Re: INFECTION BLOCKED
Post by: REDACTED on March 22, 2017, 10:24:47 PM
Kelly has infected mail detection, you have blacklisted url blocking (URL:Mal)


Search Google or YouTube for how to take a screenshot

Milos, I have tried that unsuccessfully.  BUT the screen shots that are shown by goaheadandspamme are exactly like mine for 5 of the 7 alerts.  The other two stop at =json.

I've had no problem since last night.  I've been using Chrome but did try Firefox and had no problem with it.  I read your message that the problem had been fixed.  Thank you.
Title: Re: INFECTION BLOCKED
Post by: tumic on March 29, 2017, 03:16:28 PM
Quote
After reinstalling Firefox, I get this error. I do not get this in Chrome or Safari. I'm not sure if they are less secure or if the Web Shield isn't running in those any longer or what.

If you reinstall Firefox, you need to do a logout/login which lets Avast to put the Webshield certificate to Firefox. You do not get this error in Chrome/Safari because they use the system keychain.