Google blocked, exceptions ignored

[schorhr]

Hello,
I use Avast free for a few years, and recomend it to all of my friends and family.
Today it started to block google (Infektion: URL:Mal), and even for the registration here I had to disable the real time web shield for a minute as the captcha avast uses is from Google's services ;-)
The same problem occurs with google, firefox, internet explorer.

Program and database are updated to the recent version.
Putting http://*.google.com/* (and https) into the exclusion list did not solve the problem either.
With fixed subdomain http://www.google.com/* it did not work either.
Re-installing avast did not solve it either.

Please help! :-)
Thank you.

-Marcus

[Pondus]

could you attach a screen shot of the avast warning ?

[essexboy]

Monitoring

[schorhr]

could you attach a screen shot of the avast warning ?

Hello,
thank you for your quick reply!

I attached a screenshot of one of the popups (when loading the captcha of this forum) and in the background the detail info from avast's website.
This is only an example, it will block any www.google.com URL (so mail.google.com is not affected for some reason).

//EDIT
Sorry for the double attachment. Corrected, added the screenshot of the exlude-list entries

[schorhr]

Hi again,
I now used the uninstall utility in safe mode (XP) as mentioned on another thread, re-installed it once again, but the problem remains.

I checked the host textfile to make sure google is not beeing redirected, but that's not causing the issue either.
I thought this might be the cause as only http*://www.google.* and http*://google.* is beeing blocked, while encryptet/mail/maps/.google.* and 209.85.148.94 works without problems.
Sure, I could use a different search engine, but as many forums and websites use ressources from google (ads, captchas, authentifications...) I get an error on every other website.

Heck, Avast even alerts from  google.com/favicon.ico ?
I see no alternative but to switch to a different virus protection if the problem persists. Any more ideas? I give up.

-Marcus

[essexboy]

Avast is telling you that you have a problem, changing AV's will not make the problem go away.  It just may not be evident anymore

Download OTL  to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

• Select All Users
  
• Under the Custom Scan box paste this in

netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
qmgr.dll
/md5stop
%systemdrive%\$Recycle.Bin|@;true;true;true
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BITS /s
CREATERESTOREPOINT

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Post both logs

[schorhr]

Thank you for the advice!
Here are the textfiles.
 I edited three lines where email adresses where shown in the filenames and removed a couple of lines that showed images I created/edited, and I had to upload the files across two posts, as the file upload limit caused problems.

[schorhr]

and I had to upload the files across two posts, as the file upload limit caused problems.

4 per post, maximum total size 192KB, maximum individual size 200KB
:-)

[essexboy]

Could you let me know if this is across all browsers or just one

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  
  

Code: [Select]

:OTL
IE - HKU\S-1-5-21-2538481707-3083153203-1291856630-1007\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2737658
[2010.03.08 07:38:08 | 000,102,896 | ---- | M] ( ) -- C:\Programme\mozilla firefox\plugins\nplyinux.dll
O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No CLSID value found.

:Files
ipconfig /flushdns /c
netsh int ip reset c:\resetlog.txt  /c
ipconfig /release /c
ipconfig /renew /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[schorhr]

Thank you for your quick reply!
The problem occurs with google, firefox, internet explorer (see first post).

I understand the ipconfig/flushdns, but what does the rest do (at :OTL)?

[Pondus]

looks as he is removing some toolbar crap 

[schorhr]

Never hurts :-) As I use Opera I never checked if & what toolbars are installed for IE or Firefox.

[essexboy]

OK once that has run let me know if you still have the problem

[schorhr]

Sorry for the delay, I've been sick.

The fix did not solve the problem.
I included the OTL.txt that opned after the reboot, as well as a quickscan log after that.

[essexboy]

Before I proceeed I would like a quick look at the MBR

• Download RogueKiller  and save it on your desktop.
   
  NOTE: If using IE8 or better Smartscreen Filter will need to be disabled
  
  
• Quit all programs
• Start RogueKiller.exe.
  
• Wait until Prescan has finished ... 
•     Click on Scan