Author Topic: URL:Mal  (Read 1964 times)

0 Members and 1 Guest are viewing this topic.

Offline patrik.nusszer

  • Newbie
  • *
  • Posts: 1
URL:Mal
« on: September 04, 2019, 12:01:56 AM »
Hello!

Avast keeps pushing URL:Mal notifications all the time.
I even tried reinstalling macOS more than 1 time but whenever I reinstall Avast I get these messages.
https://6eez7ouig7gwguf6.pro/v2/a/ban/iframe/48590
https://6eez7ouig7gwguf6.pro/v2/a/ban/iframe/48591
https://6eez7ouig7gwguf6.pro/v2/a/ban/iframe/48592

These are just some example URLs that are being downloaded from some app I do not know about.
Whatever is doing it uses this process to make requests:
System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.networking.xpc/Contents/MacOS/com.apple.WebKit.Networking

Any idea? I am getting paranoid because I keep reinstalling the OS but I still get these blocked threat messages.

Offline ondrej.kolacek

  • Avast team
  • Sr. Member
  • *
  • Posts: 394
Re: URL:Mal
« Reply #1 on: September 05, 2019, 11:32:07 AM »
Hello,
webkit is the Apple's web browsing framework; these are the most likely possibilities:
1) you have browsed to this page sometimes in the history; Safari remembers it and tries to access the page. This usually happens when you start Safari or type a url to the browsing bar. For this, try to clear browsing history in Safari.
2) some other application which you have installed uses webkit framework to access this page. I am not sure how to detect the potential culprit app. Maybe close as many app as possible?
3) From the fact the url is changing, I would also guess that this could be triggered by some of your opened web pages. Try to close all of these.

Please note that Apple stores a lot of stuff to the cloud, so reinstall does not help in some cases as various configuration synchronises back to the computer afterwards.

Kind regards,
Ondrej Kolacek