Firefox & Internet Explorer virus? Avast saying both are malicious...

[bluejaysforever]

Hi,

I am hoping to get any help with a problem that just started yesterday.  When I go to launch firefox, I get the "malicious threat has been detected" message.  If I continue to try and search stuff on google, whatever new page comes up, I get the same warning pop up.

I thought maybe firefox does have a virus so I tried to use internet explorer too. Same thing happened.  So THEN I tried Safari...  got no error messages with Safari.

Does anyone know if this is a virus? If it's not, I have no idea what would trigger my avast to start doing this with firefox and IE out of nowhere? 

Did a virus scan last night with Malwarebytes and it didn't detect any infected files at all.

Thanks for any help!

[DavidR]

What will help is the full text of the avast! alert or a screenshot of the avast! alert window.

[bluejaysforever]

Sure, here is a screen cap of the warning message.

Thanks!

[bluejaysforever]

Okay, so just another update... I changed my firefox homepage to tsn.ca instead of google. When I close firefox and launch it, I don't get the malicious threat warning anymore.  So it looks as though I somehow have a google virus? 

[DavidR]

Is that URL a google one the /.../ bit ?

Even with google.com as your home page that is a heck of a url string behind the /.../ concatenation of the URL.
I know there are some google redirect malware alerts, but that is normally seen in a google search, so it would be interesting to know what that \...\ part of the URL was ?

Check the C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\log\nshield.txt or C:\ProgramData\AVAST Software\Avast\log\nshield.txt (Vista, Win7, the ProgramData folder may be hidden), this contains the network shield detections.

[bluejaysforever]

Hey, thanks.  I'll attach the file for you to see.

[Nesivos]

Hey, thanks.  I'll attach the file for you to see.

I used an online scanner to scan the URL starting with the "17" which is at the beginning of the URL's in your log.   The scan appeared to ignore the 17 at the beginning of the URL and came back "clean"

I use Bing as my default search engine

So I entered the the same URL from "http" until ".com" from your log into "Bing" and clicked for Bing to search.  avast! popped up Malicious Site (something to do with Javascript) and Firefox redirected me away from the search results and to Firefox' warning page.   I closed Firefox, reopened it to my Bing homepage without a problem

[DavidR]

There are numerous other domains on that IP address and I believe this blocking is a collective one, but the hXXp://17.theppcfeed.com/feed.php URL I checked at http://anubis.iseclab.org/?action=home shows it to be suspect.

I don't know what live feeds you have in firefox, but I would certainly check and ensure that any that you didn't create, especially any for that domain (IP - that avast considers malicious, see image) are removed.

[bluejaysforever]

How would I check to see what feeds I have in firefox? Is that something that would be on my address bar?

Edit: Follow up - I checked my firefox add-ons and saw a Google Translate This! add on.  I disabled it and now I am not getting the avast warning anymore.  Would that have been it then?  How would I go about completely deleting this to make sure a virus isn't sitting in my system anymore? Just do a search for translate this on my system and delete all traces?

Thanks!

[DavidR]

I don't use Live feeds on firefox, try a search for live feeds in the browser help.

Returns info on live bookmarks, http://support.mozilla.org/en-US/search?product=firefox&q_tags=desktop&q=live+feeds