Avast WEBforum

Consumer Products => Avast Mac Security => Topic started by: patrik.nusszer on September 04, 2019, 12:01:56 AM

Title: URL:Mal
Post by: patrik.nusszer on September 04, 2019, 12:01:56 AM

Hello!

Avast keeps pushing URL:Mal notifications all the time.
I even tried reinstalling macOS more than 1 time but whenever I reinstall Avast I get these messages.
https://6eez7ouig7gwguf6.pro/v2/a/ban/iframe/48590
https://6eez7ouig7gwguf6.pro/v2/a/ban/iframe/48591
https://6eez7ouig7gwguf6.pro/v2/a/ban/iframe/48592

These are just some example URLs that are being downloaded from some app I do not know about.
Whatever is doing it uses this process to make requests:
System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.networking.xpc/Contents/MacOS/com.apple.WebKit.Networking

Any idea? I am getting paranoid because I keep reinstalling the OS but I still get these blocked threat messages.

Title: Re: URL:Mal
Post by: ondrej.kolacek on September 05, 2019, 11:32:07 AM

Hello,
webkit is the Apple's web browsing framework; these are the most likely possibilities:
1) you have browsed to this page sometimes in the history; Safari remembers it and tries to access the page. This usually happens when you start Safari or type a url to the browsing bar. For this, try to clear browsing history in Safari.
2) some other application which you have installed uses webkit framework to access this page. I am not sure how to detect the potential culprit app. Maybe close as many app as possible?
3) From the fact the url is changing, I would also guess that this could be triggered by some of your opened web pages. Try to close all of these.

Please note that Apple stores a lot of stuff to the cloud, so reinstall does not help in some cases as various configuration synchronises back to the computer afterwards.

Kind regards,
Ondrej Kolacek