Google search raises URL:Blacklist pop-up

[Steve669]

I've been getting this alert when I do a Google search on Chrome browser, too, on my Windows 10 laptop. I updated Chrome to the latest version yesterday, but it still persisted.

Following NON's lead, I checked all my Chrome extensions; I don't have Proxy SwitchySharp.

But I've been able to stop the alert by disabling CrossPilot 1.1.1, which is described as "Install Opera extensions in Chrome in a sandboxed environment". Sure hope it was me that installed that extension, because I don't remember it! But let's just hope this sticks.

[NON]

I've been getting this alert when I do a Google search on Chrome browser, too, on my Windows 10 laptop. I updated Chrome to the latest version yesterday, but it still persisted.

Following NON's lead, I checked all my Chrome extensions; I don't have Proxy SwitchySharp.

But I've been able to stop the alert by disabling CrossPilot 1.1.1, which is described as "Install Opera extensions in Chrome in a sandboxed environment". Sure hope it was me that installed that extension, because I don't remember it! But let's just hope this sticks.

Well I have CrossPilot installed too, but I don't have alerts with it enabled at least for now.

[GEGEPING]

Hi ^^

NON did you have the warning message with the previous Avast version even free or other version?

Gerald

[NON]

NON did you have the warning message with the previous Avast version even free or other version?

I'm using latest Avast, not previous version.

[Jan593]

Thanks Jan953..
I started FFox with add-ons disabled and no problem. After restart, I tried disabling add-ons one-by-one but can't figure out the culprit. Only one has been updated in the last week or two, but I fully trust it.
Is there a way to effectively troubleshoot this? Is the a scanner of some sort out there?

Unfortunately, I don't think there is any good tool to automatically troubleshoot this. But what you can do is navigate to a Google search page, and open "Web Developer" -> "Debugger" -> "Sources". You should see there on the left pane the list of add-ons that are executing a content script in the current page. If there is any add-on that should not be loaded into a Google search page, you found the culprit.

[Jan593]

Thank you for the tips, we will look into both CrossPilot and Proxy SwitchySharp if there is any hidden malicious code!

[Tom581]

Thanks Jan953..
I started FFox with add-ons disabled and no problem. After restart, I tried disabling add-ons one-by-one but can't figure out the culprit. Only one has been updated in the last week or two, but I fully trust it.
Is there a way to effectively troubleshoot this? Is the a scanner of some sort out there?

Unfortunately, I don't think there is any good tool to automatically troubleshoot this. But what you can do is navigate to a Google search page, and open "Web Developer" -> "Debugger" -> "Sources". You should see there on the left pane the list of add-ons that are executing a content script in the current page. If there is any add-on that should not be loaded into a Google search page, you found the culprit.

Thanks again Jan953...
Problem has apparently disappeared.
Yesterday, I disabled all add-ons (not restart with add-ons disabled) and turned them back on one at a time and checking for the issue each time. Even when all were back on, problem did not surface. I waited to post today to see if issue came back after reboot. It did not.
Cannot explain this.
Tried your troubleshooting and did not notice any add-ons loaded.

[GEGEPING]

Hi,

I have answer from Avast French support 

They said that it was from a bad add-on...

They advise me to disable add-on one by one and enable it one by one to see which one was bad.

I did it, but as a forumer said before, they did it without possibility to know which one wasn't good

Gerald

[Tom581]

Thanks Jan953..
I started FFox with add-ons disabled and no problem. After restart, I tried disabling add-ons one-by-one but can't figure out the culprit. Only one has been updated in the last week or two, but I fully trust it.
Is there a way to effectively troubleshoot this? Is the a scanner of some sort out there?

Unfortunately, I don't think there is any good tool to automatically troubleshoot this. But what you can do is navigate to a Google search page, and open "Web Developer" -> "Debugger" -> "Sources". You should see there on the left pane the list of add-ons that are executing a content script in the current page. If there is any add-on that should not be loaded into a Google search page, you found the culprit.

Thanks again Jan953...
Problem has apparently disappeared.
Yesterday, I disabled all add-ons (not restart with add-ons disabled) and turned them back on one at a time and checking for the issue each time. Even when all were back on, problem did not surface. I waited to post today to see if issue came back after reboot. It did not.
Cannot explain this.
Tried your troubleshooting and did not notice any add-ons loaded.

Seems this idiocy is back again. 6 days of freedom and now it is starting again. Nothing has changed in my system.

[GEGEPING]

Hi,

Welcome back 

I have the issue back.

To see if something wrong with add-on, which add-on do you have on your firefox or other navigator which occur the problem?

Gerald

[Tom581]

Hi,

Welcome back 

I have the issue back.

To see if something wrong with add-on, which add-on do you have on your firefox or other navigator which occur the problem?

Gerald

No idea Gerald. Did the same test as before and problem is still there with add-ons disbaled without a FFox restart. I am baffled.

[lorenzorodriguezmain]

Hi everyone,
I'll be copying this other reply of mine on the AVG forum:
I know it might not be what you're exactly looking for (since it's more probable you're being closely monitored as I am and this is only going to prevent you from viewing the window - check the address loaded on the pop-up, because it'll match a ton of your latest searches on Google), but, at least for now, you could edit the hosts file present at the path "C:\Windows\System32\drivers\etc" and block the address from being sucessfully opened. Remember you'll have to run the text editor (notepad, why not?) as an administrator and open the file through the own notepad prompt (ctrl + o). After this, go to the last line and create a new one with "127.0.0.1" (which is the localhost used for loopbacks; learn more at https://en.wikipedia.org/wiki/Localhost) plus the address targeted. You also should preferably press the "tab" key to separate a parameter from each other.
It seems this threat actually comes from some kind of action triggered by Crosspilot. Discussions are being proposed across other forums too, I see. 
Hope this helps.
(I attached a sample of what it also looks when running on AVG. Same deal, same issue.)

[Jesperodde]

I got this from Avast:

If the detection pops up randomly it is possible that you have hijacker in your browser. To get rid of it please follow steps described bellow:
1) Make sure that Avast is up-to-date: https://support.avast.com/en-ww/article/Update-Antivirus
2) Reset the affected web browser to its default/factory settings: https://support.avast.com/en-ww/article/Reset-browser

Did not do it yet, did anyone else?

[DavidR]

You could start by attaching a screenshot (to your reply) of the avast alert, that could help us investigate.
See my attached image on how to attach it in the post.

[Jesperodde]

Ok, this is the screenshot