Avast reports protecting me from URL:MAL

[avastyescurvydogs]

Avast is reporting that it is protecting from a URL:MAL originating from an exe related Spybot Search and Destroy.  The link is something like the-proxy-list.

Anyone know if this is false positive?  I was assuming it was but when I did a bunch of searches of the exe and the link on google I suddenly had google say I was a robot and needed to do a CAPTCHA.  It was saying they thought I was part of a botnet or something like that. Now I am really worried.  I have never seen that before.

Please respond with any help you can give.

[Diddy]

HI how is it going just thought I should tell you that if you post three times to avast forums you have to put the letters in the Captcha three times after three times of posting you will not have to do the capcha any longer it is so that spam bots cannot be you in short the capcha is  to make sure you are a human that is all nothing to worry about.

have a good wekend

[avastyescurvydogs]

Thanks for the response but you misunderstood my post.

[DavidR]

Please post a screen shot (preferred) of the alert or full text of the alert.

[avastyescurvydogs]

How can I see my history of past alerts?

[DavidR]

If you haven't rebooted or had any other popups since that, then right click on the avast tray icon and select 'Show last popup message.'

If this isn't available, then try checking these files shield text files WebShield.txt and FileSystemShield.txt in the avast Report folder.

Folder locations.
C:\Documents and Settings\All Users\Application Data\AVAST Software\Avast\report\ (XP location).
C:\ProgramData\AVAST Software\Avast\report\ (Vista or later).

[avastyescurvydogs]

from Web Shield
11/9/2013 5:43:34 PM   http://the-proxy-list.com/files/check.php?k=RAZbZIiM/FHvGlF/yXxj9g== [L] URL:Mal (0)

from Network Shield
11/8/2013 7:06:06 AM   http://the-proxy-list.com/files/check.php?k=RAZbZIiM/FHvGlF/yXxj9g== [L] URL:Mal (0)
11/8/2013 5:34:05 PM   http://the-proxy-list.com/files/check.php?k=RAZbZIiM/FHvGlF/yXxj9g== [L] URL:Mal (0)
11/9/2013 9:26:16 AM   http://the-proxy-list.com/files/check.php?k=RAZbZIiM/FHvGlF/yXxj9g== [L] URL:Mal (0)
11/9/2013 11:10:28 AM   http://windowfdb.com/q.php?q=flash64-11-9-900-117-ocx-c-windows-system32-macromed-flash [L] URL:Mal (0)
11/9/2013 11:10:28 AM   http://www.windowfdb.com/ [L] URL:Mal (0)
11/9/2013 11:10:28 AM   http://windowfdb.com/ [L] URL:Mal (0)

[avastyescurvydogs]

I never saw the other alerts from a different site so I don't know what the process they were related to.

[avastyescurvydogs]

Anyone know what these sites that showed up are or what they are related to?  Is my computer compromised?  Losing my mind just sitting here refreshing hoping for a response and waiting for football to start.

[avastyescurvydogs]

Rams are whooping the Colts.  Does anyone have anything to help me?  I have searched all over the internet and done a bunch of the typical things for these situations like malwarebytes,tdsskiller,roguekiller,full scans with avast,adwcleaner,hitmanpro.  Nothing serious has come up, just a few cookies and broken shortcuts.  I uninstalled spybot search and destroy as well.  I have not been getting the warnings from avast but I have not been doing normal browsing of the internet.  I just want to be as positive as possible that there is no problem with my computer being compromised and my online financial things in jeopardy.  I work online and access my card/payments information online.

[avastyescurvydogs]

If it matters my Avast was not the current version when I first encountered this problem as I did not know there was a new version and was stilling getting the daily definitions updates and voice over things and had no reason to believe my avast was outdated.  It is updated now.  I do not really like the new look.

Also when I click buttons on this site I keep downloading index.php.  What is this about?  It is annoying.

[propheticus]

https://www.virustotal.com/nl/url/5ff5475af8a4806465434dbc268049a91a99a27c3934baf28ae8375519db8885/analysis/
http://sitecheck.sucuri.net/results/the-proxy-list.com

Seems this is a clean site. Avast might be reporting false positives.


Same might go for windowfdb:
http://community.sophos.com/t5/Sophos-EndUser-Protection/quot-High-Risk-Website-Blocked-quot-Mal-HTMLGen-A-has-been-found/td-p/38507
But it seems it has hosted malware in the last 90 days:
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=windowfdb.com
http://sitecheck.sucuri.net/results/windowfdb.com


Some options:
- You've got a case of the malwares: try Malwarebytes.org and run their free scanner
- Spybot has already caught these files/links and placed them in quarantine or is trying to do so. Avast could have picked them up while spybot was moving them.: delete/empty the quarantine and/or exclude spybot's quarantine folder from Avast's scanning.

[avastyescurvydogs]

Thank you very much for responding to me.  I have already uninstalled spybot search and destroy.  Have I made this into a problem because I did this?

[DavidR]

I did some quick checks on  hXXp://the-proxy-list.com domain and some came back clean, one was showing a few were blacklisting it (avast has its own malicious sites list). One although showing  the-proxy-list.com as clear, there were several other domains hosted on the same host, so that may be the issue and not so much the domain.

There is an on-line contact form, http://www.avast.com/contact-form.php?loadStyles for:  * Sales inquiries; Technical issues; Website issues; Report false virus alert in file; Report false virus alert on website; Undetected Malware; Press (Media), issues.

- If you are reporting an FP, then you get another input field open, enter the web URL for the site you wish to submit for review (Network and Web Shield), etc. A link to this topic also wouldn't hurt.

[avastyescurvydogs]

Thank you for responding.  I have reported the three links through the form and linked them to this thread.  What is your opinion of how I should act from here?

Also, any answer to why when I click on buttons on this site it downloads index.php frequently?