Avast WEBforum

Other => Viruses and worms => Topic started by: EagleGhost on April 07, 2011, 03:42:11 PM

Title: Avast blocked a suspicious URL, when I was using Hotmail
Post by: EagleGhost on April 07, 2011, 03:42:11 PM
When I was using Hotmail, Avast reported, that "suspicious URL blocked" and "web shield has blocked the activity of a malicious site". The blocked virus was called "URL:Mal". Is this something serious or a false positive? Here's a screenshot about that. Please note, that my translations might not be 100% correct, because I'm using the Finnish version of Avast.

(http://i51.tinypic.com/r7jf6e.jpg).
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Pondus on April 07, 2011, 03:51:33 PM
It is not blocking malware but it is blocking a URL that is listed as bad
Did you click a link when this happend ?


do a quick scan with avast
also do a quick scan with this

Malwarebytes Anti-Malware 1.50.1 http://filehippo.com/software/antimalware/
always update so you have latest database before you scan
click the remove selected button to quarantine anything found

you may post the scan log here if anything is found

Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: koam on April 07, 2011, 04:03:04 PM
When I was using Hotmail, Avast reported, that "suspicious URL blocked" and "web shield has blocked the activity of a malicious site". The blocked virus was called "URL:Mal". Is this something serious or a false positive? Here's a screenshot about that. Please note, that my translations might not be 100% correct, because I'm using the Finnish version of Avast.

(http://i51.tinypic.com/r7jf6e.jpg).

I have repeatedly received the same Avast pop up with audio: "Threat has been detected" when navigating in Hotmail today. I have not been clicking links.  The warning comes up when I go tot he upper right of Hotmail and use the pulldown to switch accounts.  This is something I have done every day for years in Hotmail, with Avast installed.  

It appears to be a false positive.  I did a quick scan with Avast and showed no infections. My Avast stats show nothing blocked.  

I use Chrome as my main browser.

This may be related to being "logged in" to MSN Messenger while in the Hotmail session.  I don't use Messenger and noticed that I was logged into the service.  When I logged out I didn't get the Avast warning.  I logged back in and got the Avast warning again when changing accounts within Hotmail.

I can't get a screenshot of my Avast pop up, but the Kohde/Object: is very similar to EaglGhost's up through "KpU8"  after that the code changes each time.  The process is Chrome, rather than Firefox.

The URL for Hotmail while logged in is:
hXXp://sn110w.snt110.mail.live.com/default.aspx?rru=inbox&wa=wsignin1.0
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Joe S on April 07, 2011, 04:21:06 PM
I got the same thing this morning. Avast updated shortly after booting up. I accessed them OK about 10 hours ago before definitions updated.
Joe
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Pondus on April 07, 2011, 04:22:10 PM
Quote
I can't get a screenshot of my Avast pop up.....
If you click the "Pin" in top right corner of the pop-up it will stay on the screen
in avast 6 you can also adjust the time pop-ups stay up
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: koam on April 07, 2011, 04:26:18 PM
Quote
I can't get a screenshot of my Avast pop up.....
If you click the "Pin" in top right corner of the pop-up it will stay on the screen
in avast 6 you can also adjust the time pop-ups stay up
Thanks for the tip.  I tried the pin. My bad for using ALT + PRNT SCRN out of habit rather than PRNT SCRN and then editing.  I cannot get Windows to treat the pop up as the active window for ALT+PRNT SCRN. 

In any case, my popup is the same as the OP's so there's no need for it at the moment.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: udm on April 07, 2011, 04:36:39 PM
I'm getting this as well. Hopefully it's just a false positive and not a hiccup with Hotmail itself.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: EagleGhost on April 07, 2011, 04:42:56 PM
Quote
Did you click a link when this happend ?

No, I didn't click any link. I only logged in to Hotmail and checked my inbox.

Malwarebytes found nothing. I'll run Avast next.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Dazza1901 on April 07, 2011, 04:44:48 PM
Same issues here. Really annoying.

Why do things like this always happen when you least need them to? I'm in the middle of setting up my wife with a Live new account on her netbook and can't do a thing because of this nagging FP. Curse you, Murphys Law!

Tried it in Firefox and Opera, and the same results occur.

Grrrr!
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Charo on April 07, 2011, 04:54:52 PM
Hi,

I have the same problem.

It's been like an hour since I noticed it, is it Hotmail or Avast? I'm afraid to log into my other accounts.

Thanks for your help.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: becoolboy on April 07, 2011, 05:28:55 PM
yup same thing happend to me. but it seems ok if u access it thru ur window live messenger
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: montybanks on April 07, 2011, 05:53:04 PM
re the Wlxrs.com url blocking.

I am not even using Hotmail and I was linking a sub link in Wikipedia ( using Safari) It seems that in the latest update, AVAST has included a false positive which is causing problems across many sites.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: SanderN8H on April 07, 2011, 05:55:30 PM
Also got the problem here...

The moment I logged in on hotmail I got several messages and when clicking another button while still logged in (f.e. press the button to see your inbox) Avast just kept continueing to block URL's (got 10/10 in the lower right corner of Avast's message at some point, each representing an URL-block in the +/- 1 minute I was logged in). It seemed that the moment I pressed a button I got several messages in a single "wave" and then it stops, till I press another buttong and get another "wave" of messages.
I looked through them and it appears to be the same 1 or 2 "objects" (at least, the first number of digits wich I could actually see where mostly the same).

P.S. every time I say "message" or "messages", I'm refering of Avast saying it blocked an URL.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: koam on April 07, 2011, 05:57:08 PM
yup same thing happend to me. but it seems ok if u access it thru ur window live messenger

Messenger is apparently a factor.

In my case, I'm using Hotmail on the Windows Live website in Chrome.  I'm not using the Messenger application at all.

Within the Windows Live site, you can log into Windows Live and access your Hotmail accounts...Messenger is an additional function within the site and you can elect to log into that or not while staying logged into Hotmail.

I have 4 Hotmail accounts linked in Windows Live accessible through any browser.  If one of those Hotmail accounts is "logged in" to Messenger within the browser, then I get the Avast warning.  If I make sure to log out of Messenger, the Avast warnings stop.  I do not intentionally log into the Messenger within the browser, but it seems to log me into Messenger automatically at times.

Despite multiple warnings from Avast, it doesn't appear to be blocking anything I want to do.  I can still access all my Hotmail accounts and emails.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: pepe2 on April 07, 2011, 05:57:37 PM
Hmm, it's only happening in Hotmail for me so far but it looks like it's the images used in themes that are being blocked.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: kubecj on April 07, 2011, 06:17:10 PM
This is a false alarm. We're working on fixing it.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: pepe2 on April 07, 2011, 06:21:26 PM
This is a false alarm. We're working on fixing it.
Thank you, perhaps posting a notification/blog post in the meantime will help because I'm seeing a lot of 'realtime' results in Google with confused users :(
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: thetbg on April 07, 2011, 06:37:55 PM
Have a client that gets this error when she tries to access the Calendar in Hotmail. Unchecking "Scan Web (HTTP) Traffic" under Web Shield under Real Time Shields is a temporary fix.

(http://i.imgur.com/4SRqH.jpg)
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: leary on April 07, 2011, 06:42:26 PM
Same here. Very annoying.  Live Messenger is turn off so thats not the issue. Something to do with hotmail and recently because this warning is new.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Pondus on April 07, 2011, 06:44:03 PM

SEE REPLY Nr #15
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: thetbg on April 07, 2011, 06:50:49 PM

SEE REPLY Nr #15

Yes I see that, I was just posting a screenshot of a similar error that looked different from the original one, just in case it helps.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: udm on April 07, 2011, 06:51:09 PM
This is a false alarm. We're working on fixing it.

That's a big relief, thank you :)
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: steve-ru on April 07, 2011, 06:53:26 PM
This is a false alarm. We're working on fixing it.

we r waiting :\
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: ssms on April 07, 2011, 07:04:29 PM
Yes, thanks for the update kubecj.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: wtheck1230! on April 07, 2011, 07:13:17 PM
 :o are we SURE it's a false positive?
Just a few days ago, there was a thread on Facebook saying Hotmail/msn account's passwords were hacked..?
I did not click on any links in my hotmail, have pics blocked by default in it. and it would not let me enter the profile page to change my password..
since my hotmail account is linked to my Avast register, how do we KNOW FOR SURE??
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: NYYANKEE on April 07, 2011, 07:14:47 PM
Hi, I am also having the same problems I am running a scan right now with Avast all my other scans come up clean. Is it safe for me to reply back to emails? That is when I also get the message? Thanks.

NYYANKEE
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Steffanie on April 07, 2011, 07:17:55 PM
Today I updated my avast program and added the WebRep, I think it was called. Wish I hadn't! Now every time I open Hotmail I get a false positive. It even happens when I open my new mail page to write an email. Something tells me that this may be because of my email signature. Is there any way to go back to the other version? I paid for Avast and don't want to have to switch...

Thanks in advsnce.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: thetbg on April 07, 2011, 07:30:59 PM
Be patient. It's a false positive. They have said they know of the issue and are working on it. It should fix itself with an autoupdate of virus definitions. If you need access, you can temporarily disable the web shield. Just be extra careful browsing and remember to re-enable it!
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: madgravity on April 07, 2011, 07:44:48 PM
I just got a virus update a few minutes ago after having this problem and it seems that they have fixed it :)
Thanks!!!
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Bleton on April 07, 2011, 08:16:45 PM
Phew, got worried when I had this issue when logging into Hotmail.
After reading this thread, I manually updated the definitions - thanks for the fix!  :)
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: koam on April 07, 2011, 08:36:19 PM
Hmm, it's only happening in Hotmail for me so far but it looks like it's the images used in themes that are being blocked.

In the pulldown at top right you can do 3 things: Switch accounts, change themes, and log into messenger.  8 theme thumbnails appear in the pulldown. 
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Asyn on April 07, 2011, 08:45:06 PM
Again....

This was a FP and has been fixed...!!!

Update your VPS.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: MAG on April 07, 2011, 09:05:00 PM
:o are we SURE it's a false positive?
Just a few days ago, there was a thread on Facebook saying Hotmail/msn account's passwords were hacked..?
I did not click on any links in my hotmail, have pics blocked by default in it. and it would not let me enter the profile page to change my password..
since my hotmail account is linked to my Avast register, how do we KNOW FOR SURE??
Well, there seem to be three possibilities:
(i) it's not an FP, kubecj is lying to you, and avast are part of a big conspiracy with the hackers and will suppress the detection in the next VPS update
(ii)it is a FP, and you have nothing to worry about
(iii) it's a FP for everyone else, but you have a different and genuine detection.

You should be able to eliminate (iii) if after a VPS update the detections stop.

Then wheher you want to believe (i) or (ii) is up to you.  :)
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: koam on April 07, 2011, 09:22:41 PM
I updated my Avast virus defs once again and now it seems like the problem has been fixed.  Thanks.

Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Asyn on April 07, 2011, 09:31:53 PM
I updated my Avast virus defs once again and now it seems like the problem has been fixed.  Thanks.

NP, koam.
But please stop spreading useless posts around the forum. (like making fun about the tragedy in Japan..!!!)
Thanks,
asyn
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: EagleGhost on April 08, 2011, 12:34:57 PM
Can I be safe now? I mean, that is this related to the stolen Hotmail/MSN passwords case?
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: DavidR on April 08, 2011, 05:14:32 PM
It isn't related to the stolen Hotmail/MSN passwords case, it was a false positive on the network shield, which was cleared on the next VPS update.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: EagleGhost on April 08, 2011, 06:05:58 PM
Thanks for answering! I feel safe now. :)
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: DavidR on April 08, 2011, 06:19:41 PM
You're welcome.
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: Domz on April 10, 2011, 01:23:01 AM
Yeah, It's the themes, backrounds and wallpapers for hotmail. This is my avast! Network Shield log. the one tworads the bottom are for hotmail (css.wlxs). It says "bamboo_web_banner" and then the size of the image. This is a shared computer and someone else's account was stolen not to long ago so I was kinda worried at first.

21.02.2010  15:56:28  Network Shield: blocked access to malicious site google.analytics.com.jttyhhvcxmbz.info/nte/trest11/ [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 4560 ) ]
14.03.2010  15:49:00  Network Shield: blocked access to malicious site searchinvented.com/?dn=www.halebank.com&flrdr=yes&nxte=jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 4788 ) ]
09.03.2011  09:59:06  Network Shield: blocked access to malicious site vfg2.co.cc/index.php?tp=99e7406f9ea3a77f [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 9532 ) ]
07.04.2011  10:12:02  Network Shield: blocked access to malicious site css.wlxrs.com/HGjlAVvMlW6-1!iEEpuBkgo2TZKpU8RH!W4mH-UPgteZ8OD6Oxte!sCQWfQ1OB7A6B-NZoBS1jrItq7zq!v10A/OOB_2_Bamboo/15.40.1211/img/Bamboo_web_banner_1800x165_ltr.jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 5604 ) ]
07.04.2011  10:12:38  Network Shield: blocked access to malicious site css.wlxrs.com/HGjlAVvMlW6-1!iEEpuBkgo2TZKpU8RH!W4mH-UPgteZ8OD6Oxte!sCQWfQ1OB7A6B-NZoBS1jrItq7zq!v10A/OOB_2_Bamboo/15.40.1211/img/Bamboo_web_banner_1800x165_ltr.jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 5604 ) ]
07.04.2011  10:22:35  Network Shield: blocked access to malicious site css.wlxrs.com/HGjlAVvMlW6-1!iEEpuBkgo2TZKpU8RH!W4mH-UPgteZ8OD6Oxte!sCQWfQ1OB7A6B-NZoBS1jrItq7zq!v10A/OOB_2_Bamboo/15.40.1211/img/Bamboo_web_banner_1800x165_ltr.jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 5604 ) ]
07.04.2011  12:08:28  Network Shield: blocked access to malicious site css.wlxrs.com/HGjlAVvMlW6-1!iEEpuBkgo2TZKpU8RH!W4mH-UPgteZ8OD6Oxte!sCQWfQ1OB7A6B-NZoBS1jrItq7zq!v10A/OOB_2_Bamboo/15.40.1211/img/Bamboo_web_banner_1800x165_ltr.jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 2288 ) ]
07.04.2011  12:09:53  Network Shield: blocked access to malicious site css.wlxrs.com/HGjlAVvMlW6-1!iEEpuBkgo2TZKpU8RH!W4mH-UPgteZ8OD6Oxte!sCQWfQ1OB7A6B-NZoBS1jrItq7zq!v10A/OOB_2_Bamboo/15.40.1211/img/Bamboo_web_banner_1800x165_ltr.jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 2288 ) ]
07.04.2011  12:10:18  Network Shield: blocked access to malicious site css.wlxrs.com/HGjlAVvMlW6-1!iEEpuBkgo2TZKpU8RH!W4mH-UPgteZ8OD6Oxte!sCQWfQ1OB7A6B-NZoBS1jrItq7zq!v10A/OOB_2_Bamboo/15.40.1211/img/Bamboo_web_banner_1800x165_ltr.jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 2288 ) ]
07.04.2011  15:10:30  Network Shield: blocked access to malicious site css.wlxrs.com/HGjlAVvMlW6-1!iEEpuBkgo2TZKpU8RH!W4mH-UPgteZ8OD6Oxte!sCQWfQ1OB7A6B-NZoBS1jrItq7zq!v10A/OOB_2_Bamboo/15.40.1211/img/Bamboo_web_banner_1800x165_ltr.jpg [ C:\Program Files (x86)\Internet Explorer\iexplore.exe ( 6120 ) ]
Title: Re: Avast blocked a suspicious URL, when I was using Hotmail
Post by: REDACTED on October 18, 2014, 11:31:06 AM
The moment I logged in on hotmail I got several messages and when clicking another button while still logged in (f.e. press the button to see your inbox) Avast just kept continueing to block URL's (got 10/10 in the lower right corner of Avast's message at some point, each representing an URL-block in the +/- 1 minute I was logged in). It seemed that the moment I pressed a button I got several messages in a single "wave" and then it stops, till I press another buttong and get another "wave" of messages.
I looked through them and it appears to be the same 1 or 2 "objects" (at least, the first number of digits wich I could actually see where mostly the same). Thank for share. I need it