js/adware.agent.aw

[agus 0]

I have an alert from my Internet Security detecting a js/adware.agent.aw. The alert says that chrome is trying to connect to a.xfreeservice.com (https:// a.xfreeservice.com/partner/8oB939m/index.php)

 This only happen when I perform a search in google or bing. In other searchers like duckduckgo or yahoo do not happen. Obviously, I have done an analysis to my pc but eset didn´t find anything.

Any suggestions?

 

 

[Marcos 5,453]

Does it happen when you use Chrome, Edge, IE or another browser? Have you tried disabling all Chrome extensions?

[Tengo 0]

Having the same issue on Chrome, Windows 10, it's popping out on Bing and Google searches

[Marcos 5,453]

2 minutes ago, Tengo said:

Having the same issue on Chrome, Windows 10, it's popping out on Bing and Google searches

Please answer the question above.

[Davide 0]

Hi everyone! I fixed the problem by removing the ad block exstension! Why it started giving this problem?

Edited April 22, 2020 by Davide

[Tengo 0]

fixed by removing Google Chrome Extension (Download image)

[Nightowl 206]

3 hours ago, Davide said:

Hi everyone! I fixed the problem by removing the ad block exstension! Why it started giving this problem?

Replace with uBlock origin.

 

2 hours ago, Tengo said:

fixed by removing Google Chrome Extension (Download image)

That could be a problematic or malicious or bad extension.

[agus 0]

Hi Marcos, sorry for the delay.
I have only installed  adobe acrobat, google documents offline, pinterest and vimeo video downloader . Also docs, sheets and slides from google. But none of them recently installed.
In Internet Explorer and Edge I believe that this behavior does not reproduce. Ah, another strange thing is that it is not constant in time. 
I started with this warning yesterday in the morning, in the afternoon it was not show any more. This morning eset started showing it and in the last ours of the morning they disappeared. Now eset does not show any warning.

https://chrome.google.com/webstore/detail/adobe-acrobat/efaidnbmnnnibpcajpcglclefindmkaj
https://chrome.google.com/webstore/detail/google-docs-offline/ghbmnnjooekpmoecnnnilnnbdlolhkhi
https://chrome.google.com/webstore/detail/pinterest-save-button/gpdjojdkbbmdfjfahjcgigfpmkopogic
https://chrome.google.com/webstore/detail/vimeo-video-downloader/cgpbghdbejagejmciefmekcklikpoeel

https://chrome.google.com/webstore/detail/docs/aohghmighlieiainnegkcijnfilokake
https://chrome.google.com/webstore/detail/sheets/felcaaldnbdncclmgdcncolpebgiejap
https://chrome.google.com/webstore/detail/slides/aapocclcgogkmnckokdopfmhonfmgoek

[Tengo 0]

1 hour ago, Nightowl said:

Replace with uBlock origin.

 

That could be a problematic or malicious or bad extension.

the problem is, the user is reporting he never installed this extension!

[itman 1,801]

4 hours ago, Nightowl said:

Replace with uBlock origin.

👍

[Gabszao 0]

@agus I have Vimeo extension like you. I changed how Vimeo read and write data from websites to "when you click on it" and that solved my problem. Try that and let us know!

Regards,

Gabriel

Edited April 24, 2020 by Gabszao

[Nightowl 206]

On 4/24/2020 at 3:19 PM, Gabszao said:

@agus I have Vimeo extension like you. I changed how Vimeo read and write data from websites to "when you click on it" and that solved my problem. Try that and let us know!

Regards,

Gabriel

It could be some kind of advertising script that Vimeo is trying to use and then ESET blocks , I would rather get rid of any extensions that will bring any kind of problems.

[Ofan 0]

On 4/22/2020 at 7:14 PM, agus said:

 vimeo video downloader

I had this one too along with PixiJS dev tools. Since removing the vimeo extension, I haven't see the warning.

[dv23 0]

Hello, i am having the same problem!! does anyone know how to remove it? thanks

[Marcos 5,453]

Please always provide logs collected with ESET Log Collector so that we have detailed information about the detection and your ESET configuration.

You can try:
1, Disabling syncing in the browser options
2, Disabling browser extensions
3, Trying another browser and see if the detection occurs with it as well
4, Uninstalling the browser including the user profile and installing it from scratch.

[agus 0]

I`m here again. Since the las post I had not any warning until this morning.

In edge, internet explorer and firefox I had no warnings. But they kept popping up in chrome with google.

At this point I decide to uninstall chrome and reinstall, now, at this moment I have not warnings.  Ah, the first time that I uninstalled chrome I did not delete the user profile and the warnings came out again

 

PS: sorry for the absence but I had a very busy days, work plus my sons school duties made me completely forget about this matter

[Noelia 0]

Buenas tardes, a mi tambien me da ese aviso de error y solo me ocurre cuando busco en el buscador de google chrome "Fecha y hora;Módulo de análisis;Tipo de objeto;Objeto;Detección;Acción;Usuario;Información;Hash;Visto por primera vez aquí
07/05/2020 13:27:10;Filtro HTTP;archivo;https://a.xfreeservice.com/partner/8otB939m/index.php;JS/Adware.Agent.AW aplicación;conexión finalizada;LAPTOP-3SNK364G\noeli;Suceso ocurrido durante un intento de acceder a Internet por parte de la aplicación: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (784ADEE709B6056B1EE337B7E1D1E2537B4A1A3E).;C27AEB601EA46CBC0FC648872F314F7FB9BBF748;"

Desistale el google chrome y volver a instalar, funciono durante unos dias pero ha vuelto a salir el aviso de virus. He imtentado bloquear todas las paginas web sospechosas tambien la que aparece en el mensaje (ttps://a.xfreeservice.com) pero sigue saliendo.

Ya no se que hacer. ¿Alguna recomendación?

Gracias y un saludo

 

Machine translation:

Good afternoon, it also gives me that error notice and it only happens to me when I search the google chrome search engine "Date and time; Analysis module; Object type; Object; Detection; Action; User; Information; Hash; Seen for the first time here
05/07/2020 13:27:10; HTTP filter; file; hxxps: //a.xfreeservice.com/partner/8otB939m/index.php; JS / Adware.Agent.AW app; connection terminated; LAPTOP-3SNK364G \ noeli; Event occurred during an attempt to access the Internet by the application: c :\ Program Files (x86) \ Google \ Chrome \ Application \ chrome.exe (784ADEE709B6056B1EE337B7E1D1E2537B4A1A3E) .; C27AEB601EA46CBC0FC648872F314F7F489BF

Remove the google chrome and reinstall, it worked for a few days but the virus warning has returned. I have tried to block all suspicious web pages also the one that appears in the message (ttps: //a.xfreeservice.com) but it keeps coming out.

I do not know what to do. Any recommendation?

[Marcos 5,453]

Since this is an English forum, we kindly ask you to post in English.

Maybe you have installed a bad extension again. Try disabling all extensions or uninstall Chrome, remove the Chrome user profile folder and install it from scratch.

[itman 1,801]

4 hours ago, Noelia said:

I do not know what to do. Any recommendation?

Do you have Chrome Sync enabled? If so, read this: https://forums.malwarebytes.com/topic/258886-chrome-secure-preferences-detection-always-returns/

[Guest]

I have the same problem, and despite having done everything indicated above, the notification still appears :(

[grandemonio 0]

Hi,

I started getting this notification (js / adware.agent.aw a.xfreeservice.com) in the Opera Browser. I had the Vimeo Video Downloader extension installed. I deleted it and it no longer detects anything.