Malware?

[Jyoohan]

Gotten notifications about some kind of malware called URL:Blacklist from go.clasrv.com or something close to that. Is anybody else getting this and is it something that needs to be addressed?

 

[Plykiya]

@Jyoohan Sounds like you picked up a malware somewhere that tries to redirect you to ads? Do you run or use any WordPress sites that could've been compromised?

https://www.reddit.com/r/antivirus/comments/72lllc/oneclickrevcom_adwarebrowser_hijacker/
https://www.reddit.com/r/Wordpress/comments/89vmp0/suspicious_code_found_in_theme/

 

[Holo]

We don't use anything from that domain.

You got a screenshot?

 

[Samhill]

Virus Total says MD is good. You can try online scanner, like NOD 32 or Trend Micro, if you don't want to install.

 

[Jyoohan]

I have Avast running and it's up to date. It terminated the connection and my computer is clean. Though, the notification didn't happen today. Maybe it was a weird fluke?

 

[scarlet_breaking]

Avast is among the worst av out there

 

[Lafftore]

https://malwaretips.com/blogs/remove-go-oclasrv-com/

Looks like you got adware bundled with one of your downloads. Some free programs will bundle malware with your installation.

What do you think is the program you downloaded in the past that caused this malware to manifest on your computer?

___________________________

From the MalwareTips guide:

This Go . oclasrv . c o m redirect is usually caused by adware installed on your computer. These adware programs are bundled with other free software that you download off of the Internet. Unfortunately, some free downloads do not adequately disclose that other software will also be installed and you may find that you have installed adware without your knowledge.

Once this malicious program is installed, whenever you will browse the Internet, unwanted advertisements will pop-up on web pages that you visit. These ads are aimed to promote the installation of additional questionable content including web browser toolbars, optimization utilities and other products, all so the adware publisher can generate pay-per-click revenue.

You may also see in the browser status bar the following messages: “Waiting for Go . oclasrv . com”, “Transferring data from Go . oclasrv.c o m”, “Looking up Go . oclasrv. c o m”, “Read Go . oclasrv.c o m”, “Connected to Go . oclasrv . c o m”.

When infected with this adware program, other common symptoms include:

* Advertising banners are injected with the web pages that you are visiting.
* Random web page text is turned into hyperlinks.
* Browser popups appear which recommend fake updates or other software.
* Other unwanted adware programs might get installed without the user’s knowledge.

Note: I separated the letters in the link, so no one would accidentally click on it and be redirected to the malware url.

 

[Jyoohan]

Many thanks