URL:Blacklist in Avast and AVG: what it means and what to do
URL:Blacklist is the label Avast and AVG show when their Web Shield blocks a web address that is on Avast's own blacklist. It says an address was stopped, not that a file on your PC is infected, so read the blocked address before you exclude, delete or switch anything off.
Facts checked October 14, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If an Avast or AVG Web Shield alert URL:Blacklist that names a blocked web address keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove URL:Blacklist yourself 5 steps, about 15 minutes, no software needed.
Start the steps
URL:Blacklist: summary
| Type | An Avast and AVG Web Shield alert for a blocked web address on Avast's blacklist; not a file and not one virus |
|---|---|
| Risk | Varies by address: a rogue ad or redirect domain, a site that serves malware, or a normal site listed by mistake. Treat as medium until you know the address |
| Symptoms | A Threat secured window with the headline and the words URL:Blacklist, and a page that will not open; usually nothing else |
| How to get rid of it | Read the blocked address, look it up without opening it, report a suspected false positive to Avast, and scan, check extensions and reset the browser only if the alert keeps returning |
| Our check (6 October 2026) | No site or PC test: we read Avast Community threads from 2020 to 2024 and Avast support excerpts; no sample was run |
| First seen | The label is in an Avast Community thread of 16 August 2020; our guide 5 October 2020 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Detection | Avast and AVG: URL:Blacklist, from the Web Shield, for a web address. Microsoft Defender has no name for this alert; its own names look like Trojan:Win32/<family> and describe files, so a Defender scan may show a different name or none |
|---|---|
| Shown by | Avast and AVG (Web Shield), in the Threat secured window |
| Not to be confused with | Botnet:Blacklist (a blocked connection from a program), URL:Mal, URL:Phishing and URL:Scam (other kinds of blocked address) |
| Name | URL:Blacklist |
| Evidence | 0 write-ups by security sites; details still limited |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Avast Community threads from 2020 to 2024, two Avast support pages (search excerpts only), Google's Chrome help, Mozilla's Firefox help and Microsoft Learn. We ran no sample and tested no PC or site. The removal steps follow the vendors' pages and were not tried on a live infection. A quiet result from any check does not clear an address or a PC.
What URL:Blacklist is, and what it is not
URL:Blacklist is the label that Avast and AVG put on a web address they have blocked because it sits on their own list of dangerous addresses. The alert says an address was stopped. It does not say that a file on your PC is infected, and it does not say the address was fine.
- 1
What the alert says
In our 2020 pictures an AVG window reads Threat secured and says the antivirus safely aborted a connection on a web address because it was infected with URL:Blacklist. Under it sit a list of details (threat name, severity, URL, process, detected by, status) and a Scan my PC button. The word infected describes the address at the other end, not your files.
- 2
Which list it is
Avast's own blacklist of web addresses. An Avast employee wrote in an Avast Community thread of January 2024 that URL:blacklist is plain malware, meaning addresses known to serve it, and that false positives can still happen, as they can with file detections. A volunteer in an April 2024 thread said only the Avast virus team can list an address as URL Blacklist and remove it again. We found no public page that describes the list or how an address gets on it.
- 3
What it is not
Our 2020 guide called it a malware detection notification that is mostly a false positive. It is neither a virus name nor a verdict that the alert is false. There is no file called URL:Blacklist to find or delete, and the alert quarantines nothing. It is a block of one address, and the address can be a rogue ad domain or a normal site that was listed by mistake.
- 4
Why people look it up
Because the window offers a scan and says more threats may be lurking, which sounds like an infection. The same window appears when you open a perfectly normal site that redirected you somewhere bad for a moment, as the first case below shows.
- Shown by
- Avast and AVG (the same company), from the Web Shield that watches web traffic
- What was found
- A web address on Avast's blacklist, blocked before it loaded. No file is named as infected
- What the alert quarantines
- Nothing. Status reads Connection aborted: the connection was stopped, no file was moved
- Who can change it
- Only the Avast virus team can remove an address from the list; you can report it
- Not the same as
- Botnet:Blacklist (a blocked connection to an IP address from a program), URL:Mal, URL:Phishing and URL:Scam (other kinds of blocked web address)
Is uBlacklist the same as URL:Blacklist?
No, uBlacklist and URL:Blacklist are two unrelated things with similar names.
URL:Blacklist is an alert from Avast and AVG Web Shield about a blocked web address. uBlacklist is a browser extension that hides chosen sites from your search results. One does not cause or fix the other.
uBlacklist is a free, open source extension by a developer who goes by iorate, published on GitHub under the MIT License. Its own page describes it as a way to block specific sites from appearing in Google search results. It also works with Bing, DuckDuckGo, Brave and some other search engines.
It runs in Chrome, Edge and Firefox, and in Safari on Mac and iPhone. You add a rule from a search results page or from the toolbar icon. A rule can be a match pattern such as *://*.example.com/*, or a regular expression. You can also sync your rules between devices or subscribe to public lists of sites.
If you only want the extension, install it from your browser's own add-on store and check that the developer is iorate. If you see a blocked page and an Avast alert at the same time, the alert comes from Avast, not from uBlacklist. Our reading is that people searching for ublacklist mostly want the extension, and we have not tested it ourselves.
What URL:Blacklist does on an infected PC
How to read the alert, line by line
Every URL:Blacklist window has the same lines. This is what each tells you, from our 2020 pictures and the Avast Community threads of 2020 to 2024.
| Line in the alert | What it shows | What it tells you |
|---|---|---|
| Headline | Threat secured | Avast or AVG stopped something. It is the same headline for a rogue ad address and for a normal site on the list |
| Sentence under it | We've safely aborted connection on an address because it was infected with URL:Blacklist | The address is on the list. The address named is the one that was blocked, and it may not be the page you typed (see the first case below) |
| Threat name | URL:Blacklist | The label of the list. It says nothing about what is on the page |
| Severity | A bar with three segments (one filled in our 2020 picture) | We found no source that explains it, so we do not read anything into it |
| URL | The blocked web address (blurred in our pictures) | The line to read first. Note the domain, and write down the whole address before you close the window |
| Process | The program that asked for the address (blurred in our pictures) | A browser, usually. A program you do not know asking for a listed address is a reason to look further |
| Detected by, Status | Web Shield, Connection aborted | The part of the antivirus that watches the web, and the fact that the block already happened |
| More threats may be lurking, Scan my PC | A button offered under the headline | An offer to scan. It is not a finding, and a scan is only worth running if the other signs below show up |
What we checked on 6 October 2026, and what we could not
There is no website to test here and we ran no PC test or sample. We read Avast's own forum threads and support pages, and we looked at our three 2020 pictures. We ran nothing on a PC.
Our reading of the sources, 6 October 2026
- The alert is real and widely reportedAvast Community threads from August 2020 to June 2024 show people receiving it for many sites, and Avast employees answered several of them. It is not a scam pop-up.
- Avast says false positives happenAn Avast employee wrote in January 2024 that false positives might happen. In August 2020 and September 2020 Avast employees removed a listing after a report.
- What the list containsNot published. We found no page that explains the list, how often it changes or how an address is added.
- Whether a given alert is a real hitCannot be told from the alert. In one case the listing came from a redirect to a malicious site that a normal site sent visitors through. In another a site was listed again after Avast had removed it.
- The addresses in our 2020 picturesupviral.com, special-offers.online and a long address on a domain that starts fd7qz88ckd. We did not visit or test them, so we say nothing about what they serve today.
- Avast's exception pagesWe read only the search excerpts of two Avast support pages (the exception route and a warning to trust a site fully before you add it). The pages themselves did not load for us, so we did not follow the exception steps.
- A quiet result elsewhereDoes not clear an address. Other engines judge addresses differently, and an adware domain can serve something else to a scanner than to a visitor. A volunteer in April 2024 noted that Avast does not appear in VirusTotal's website results, because Avast only checks websites live and not on demand.
Unknown until you know the address One alert can be a stopped rogue ad domain or a listed address on a normal site. We saw nothing on any PC and tested no site, and a quiet check never proves an address or a PC clean. Find the blocked address and what led to it, then follow the check chapter.
Sites and addresses behind the alert: real and false alarms
These are the cases we could read. They show how different the causes are. They are not a list of what your alert is.
| Case | What the source says | How it ended |
|---|---|---|
| A video converter site, August and September 2020 | A long-time Avast user was blocked on a site he used every week, but only on the French version of the page. A volunteer pointed him to Avast's false positive form and said to expect a reply within 48 hours. An Avast employee said it should be fixed since 28 August 2020, 19:03 CET. The block came back in September, and another Avast employee wrote that a redirect had sent visitors to a malicious site (named in the thread, which we do not repeat) | Detection removed after both sites looked clean again. The reporter's case shows how a normal site can be listed for what it redirects to |
| A small business site, January 2021 | A user could not open a site and was told by Avast that it was blacklisted. A volunteer found an outdated WordPress and out-of-date plug-ins on it, and one engine on VirusTotal calling it suspicious, and wrote that only Avast team members can unblock a site or call it a false positive | No Avast answer in the thread. The volunteer asked whether the site was still compromised |
| A personal site, February 2021 | A user asked Avast to remove a site from the URL blacklist. A leader noted that the weekend meant fewer staff in the virus lab, and that a scan service gave the site a medium security risk | The user had already sent a false positive report; no result shown |
| A streaming site, January 2024 | A user complained that URL:scam, URL:phishing and URL:blacklist blocks leave no option to go through. An Avast employee answered that blocking a site known to serve malware gives layered protection, and that URL:blacklist is plain malware. A volunteer added that Avast also blocks single elements of a page, such as an ad domain, and not only the site | The user asked for an opt-out; none was offered in the thread |
| Video sites, April 2024 | A user said Web Shield blocked many video sites and that a site was removed from the list and later added again. Volunteers answered that only the Avast virus team can remove an entry and that pirated video sites can carry more than a video | Not shown. The user switched to another antivirus |
How the alert has turned up, 2020 to 2024
Our 2020 guide treated it as a new warning to be handled with scans. The Avast threads show the same label turning up on different kinds of site over four years.
Aug 2020
A normal site is blocked
An Avast Community user posts that a site he has used for years is blocked with URL:Blacklist. An Avast employee says it is fixed on 28 August.
Sep 2020
The block returns
The same user is blocked again. An Avast employee finds a redirect to a malicious site and removes the detection once both sites look clean.
5 Oct 2020
Our first guide
The 2020 guide called the alert a mostly false positive malware detection and advised resetting the browser, scanning with a second tool and contacting the antivirus maker.
Dec 2020
No local list to edit
A user writes that adding a Web Shield exception, even with a wildcard, did not stop the block, and asks whether the list can be edited locally. We found no reply that confirms either.
Jan to Feb 2021
Small sites caught
Users of a company site and a personal site report blocks. Volunteers point to outdated site software and a single VirusTotal flag, and tell them to wait for Avast.
Jan 2024
Streaming sites and the opt-out question
A user asks for a way to switch off URL: blocks while keeping the malware shield. An Avast employee describes the block as layered protection.
Apr 2024
Video sites, again and again
A user says a site was removed from the list and then listed again, and that more sites were blocked than he could report.
Jun 2024
The 2020 thread's last post
The August 2020 thread still draws replies, 55 posts in all.
What the alert shows, and what to do about it
The threat name is only a clue. The blocked address and what led you to it decide what to do. Open the details before you click anything.
| What happened before the alert | What it points to | What to do |
|---|---|---|
| You typed or clicked a site you know and trust | The listing of the site or of something it loads or redirects to, as in the 2020 case | Do not exclude the site yet. Report it to Avast, wait for the answer and use the site later |
| The window names a domain you never heard of | An ad, a redirect or an embedded script that your browser asked for. The 2024 volunteer said Avast also blocks single page elements | Close the window, and see the entry and check chapters. Look for adware if it keeps happening |
| It appears right after you start a download or an installer | The address that hands out the file, or an ad on the download page | Delete the download. Get the program from its maker instead |
| It appears every few minutes without you browsing | A program, an extension or a tab that keeps asking for the address | Open Task Manager and your browser's extension list; see the removal chapter |
| It only appears on a streaming or file-sharing site | Ad networks on such pages are often the listed part | Leave the site. Do not add an exception to keep watching |
| The alert says the process is something you do not know | A program on the PC is the one asking for the address | Check where the file is and who signed it before anything else |
What URL:Blacklist can steal or download
What a real hit can cost you, and what a false one can
If the address serves malware, the risk is what a malicious page can do to you. If it is a false positive, the cost is a site you cannot open. Our 2020 guide listed only a vague threat.
- Medium
A page that serves malware or a scam
An Avast employee described the list as addresses known to serve malware. An address on it may hand out a fake update, a rogue installer or a scam page. The block means you did not see it this time.
- Medium
Adware sending you to such pages
Our 2020 guide tied the alert to adware: pop-ups, random redirects and advertising material. The alert itself does not say that adware is on your PC, but a block that keeps coming back without you browsing is the pattern to take seriously.
- Medium
An exclusion that hides a real threat
Avast's support says to use website exceptions only for a site you fully trust, because exceptions reduce protection. An address added to silence a false alert hides a real one in the same way.
- Low
A false positive on a site you need
The cases show sites blocked for a day or two and then cleared. The cost is time and a workaround, and sometimes it comes back.
- Low
A scare that leads to a worse choice
Switching your antivirus off, installing a cleaner because a pop-up says so, or paying for tech support are the usual wrong steps after an alert like this.
What you may notice, and what the sources show
Our 2020 guide listed browser crashes, pop-ups, random redirects and advertising material as signs. They are signs of adware, and the alert alone is not one of them.
| Sign | What we found |
|---|---|
| The Avast or AVG window itself | Often the only sign. Most users in the threads mention nothing else |
| The same alert again and again, with no browsing | A program, tab or extension keeps asking for the address. From the 2020 guide's pop-up and redirect list |
| Pop-ups, random redirects, advertising material | From the 2020 guide. A reason to check extensions and installed programs |
| The browser crashes out of nowhere | From the 2020 guide. Common causes are many, so it points to adware only with the other signs |
| A page you wanted will not open, with an Avast window | The usual user report in the threads: the site is blocked, and you did nothing wrong |
| Nothing at all | A rogue page can be blocked before it does anything. A quiet PC is not proof that the PC is clean |
How to check the PC for URL:Blacklist
How a browser ends up asking for a listed address
No source we read says how a particular alert arrived, so these are the routes the cases and our 2020 guide describe. Our 2020 guide called the cause a threat that got in during a freeware installation or on a malicious site.
- 1
A normal site that redirects through a bad address
The September 2020 case: visitors were sent through a malicious domain from a site that was otherwise fine, and the site was listed until it looked clean again.
- 2
Ads and shady pages
Our 2020 guide said the alert is common if you visit advertising services and similar pages with shady purposes. The threads agree: the blocked address is often an ad or a script and not the page you opened.
- 3
Freeware and bundles
Our 2020 guide said freeware installations, other potentially unwanted programs and malicious sites can all lead to an infiltration. A download from a site that bundles extras can add an extension or a program that opens pages in the background.
- 4
Pirated and file-sharing sites
An Avast leader said in 2024 that pirated content could bring more than a video. Such sites are among those blocked most often in the threads.
- 5
A site that was hacked
The January 2021 volunteer found outdated software on a blocked site, a typical way a small site is turned into a redirect. This is an example, not a finding about that site.
Check the address before you exclude or delete anything
Do not exclude the site, switch Avast off or delete anything until you have written down what the alert says. Our 2020 guide told readers to look at the site or file that triggered the alert, and that still holds, with one change: look it up, do not open it.
- 1
Copy the alert
Take a screenshot. Open the details and write down the URL line, the process, the time and what you were doing.
- 2
Do not open the address to see
Our 2020 guide said to check the site or file yourself. Opening a blocked address is how the harm happens. Look it up from a search page or an address-lookup service instead.
- 3
Look it up
Search the domain on VirusTotal and on a site scanner such as Sucuri SiteCheck, as volunteers did in the threads. Use them as clues. A volunteer noted that Avast does not show up in VirusTotal's website results, so a clean VirusTotal page does not clear what Avast listed.
- 4
Ask whether it is the site or a thing the site loads
The Avast alert names the blocked address. If it is a different domain from the one in your address bar, it was something the page loaded or redirected to.
- 5
Check whether anything is on your PC
Open Settings > Apps > Installed apps and sort by install date. Look at your browser's extension list. Anything you did not choose and cannot explain is a candidate.
- 6
Note whether the alert repeats
Once, after one site, is a block. Repeated without you browsing is the sign to follow up in the removal chapter.
How to remove URL:Blacklist
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to URL:Blacklist or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 2: Remove it from startup
Whatever URL:Blacklist installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove what is behind it from Windows 11 and Windows 10
The alert needs no removal: Avast or AVG already stopped the connection. There is no virus named URL:Blacklist to remove. These steps are for when the alert keeps coming without you browsing, or comes with pop-ups and redirects. Do them in order and stop when the alert has not returned. We did not run these steps on a live infection; they follow Microsoft's and the browser makers' own pages.
- 1
Scan with a second tool
Our 2020 guide said to scan with a tool other than the one that showed the alerts, and that is still good advice. Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and click Scan now. Microsoft says the PC restarts and signs you out before the scan, so save your work first. If Windows Security is turned off because you run another antivirus, use that tool's full scan instead.
- 2
Uninstall what you do not know
Open Settings > Apps > Installed apps, sort by install date, and remove programs that appeared around the time the alerts began and that you did not choose. That is our rewrite of the 2020 guide's Windows uninstall block.
- 3
Remove unknown browser extensions
In Chrome open More > Extensions > Manage extensions; in Edge Extensions > Manage extensions; in Firefox Add-ons and themes > Extensions. Remove any you did not install. We did not confirm these extension menu names against the vendors' pages.
- 4
Reset the browser that showed the alert
Our 2020 guide said to reset the browser to default. In Chrome, select More > Settings > Reset settings > Restore settings to their original defaults > Reset settings. Google says this keeps bookmarks and passwords and changes the search engine, home page, pinned tabs, content settings, cookies and extensions back to default. In Firefox, open the menu, choose Help > More troubleshooting information (we could not read these two labels on Mozilla's page) and click Refresh Firefox. Mozilla says it keeps bookmarks, history, passwords, cookies and form data and removes extensions, site permissions, modified preferences and added search engines. In Edge the same reset sits under Settings > Reset settings; we did not confirm it against Microsoft's page.
- 5
Update, then watch
Update Windows (Settings > Windows Update), your browser and your antivirus, and see whether the alert returns after a day of normal use. An update does not remove anything, but old software is how many infections start.
- 6
If one thing is still wrong
Back up your documents, then use Settings > System > Recovery > Reset this PC. This is the last step, and most readers never need it.
Never download a removal tool because a pop-up, a stranger or a phone number tells you to. We name no product as a remover, and no scan can promise to remove every trace of adware. Our 2020 guide said a removal tool can also check for file damage so the PC runs smoother. That is a claim about a product we cannot support, so we dropped it.
Could it be a false alarm?
Often, yes: Avast removed listings after reports in 2020. But the alert alone cannot tell you, and the fact that other tools find nothing does not clear it. Only Avast can say the address was listed by mistake.
| Points to a real problem | Points to a false positive |
|---|---|
| The address is a domain you never heard of, in an ad or a redirect | The address is a site you use, or a well-known service |
| It started after a download, an installer or a new extension | It started on a day, with other users reporting the same site in forums |
| The alert repeats without you browsing | It appears only when you open one page |
| Other tools or a Defender scan name something on the PC | Nothing else is found, and the site's owner can show that it is clean |
| The site is outdated or compromised, as the 2021 volunteer found | The site's owner says it was fixed and Avast has not yet updated |
- 1
Report it to Avast
A volunteer in 2020 pointed to Avast's false positive form for a suspected false positive (a file or a website); Avast employees answered threads where the report was made. Include the exact address, what you were doing and the time. A volunteer said to expect a reply within 48 hours; that is a volunteer's remark, not an Avast promise.
- 2
Wait for the verdict
A volunteer wrote that only Avast team members can unblock a site or call it a false positive. In 2021 a leader added that the virus lab may have fewer staff at a weekend.
- 3
Do not switch protection off
Our 2020 guide told readers to contact their antivirus maker, and that part stands. A shield that is off protects nothing, and the listing is not proved false.
- 4
Check for two security programs at once
Our 2020 guide said that running several anti-malware tools at the same time can cause such messages. Real-time protection from two products can clash, and one of them can flag the other's traffic. A second tool is for an occasional scan, not for the whole day.
- 5
Use an exception last
Avast's support says to open the menu, go to Settings > General > Exceptions and click Add exception, and to add a website only if you fully trust it, because exceptions reduce protection. We read this as a search excerpt and did not test it. A user in 2020 wrote that an exception did not stop this block, and we could not confirm either way.
- 6
Ask support, not a stranger
Our 2020 guide said to ask your antivirus provider for help. The Avast Community forum is where the Avast employees in these cases answered. Changing antivirus is what some users did, but it only moves the same question to another list.
After removal: passwords, accounts and prevention
Secure your accounts after the clean-up
Assume that whatever was saved in the browsers on this PC while the PC showed an Avast or AVG Web Shield alert URL:Blacklist that names a blocked web address in the list of installed apps has been copied:
- passwords
- cookies
- autofill data
Work from a clean device, or from this PC once the offline scan finds nothing.
Start with your main e-mail account, because it can reset everything else, then banking and payment, then social and gaming accounts. Change each password, sign out of all sessions and turn on two-step verification: Turn on two-step verification / secure a hacked account.
The full order, including crypto wallets and card replacement, is in securing your accounts after malware.
If you opened the site or ran a download
The steps above deal with the alert. These deal with what may have happened before it appeared.
- 1
Delete what you downloaded
If a file came from the page that led to the alert, delete it. Do not run it, even if the page said it was an update.
- 2
Change passwords from another device
If you typed a password into a page that was then blocked, change it, email first. Turn on two-step sign-in.
- 3
Check your money
Look at card statements and any wallets for payments you did not make.
- 4
Scan again in a week
Run Windows Security's scan again and keep the alert screenshot. Check that the alert has not returned for the same address.
Keep rogue addresses off your screen
Our 2020 guide said to avoid rogue sites and bundled installs and to choose Advanced or Custom options. The advice stands.
Do
- Download programs from their makers or from the Microsoft Store, not from sites that bundle extras. Our 2020 guide told readers to go for legitimate sources to avoid software bundling.
- In an installer, always choose Advanced or Custom and untick what you did not ask for, so that the choice is yours. The 2020 guide said the same.
- Keep Windows, your browser and your antivirus updated, and keep one real-time antivirus.
- Keep a backup of your documents (File History or OneDrive) on a disk you unplug. It also protects against a wrong deletion. This replaces the 2020 guide's data recovery block.
- Report an alert you think is false to Avast, with the full address.
Don't
- Do not open a blocked address to see what is there.
- Do not exclude a site just to stop the pop-up.
- Do not click pop-ups that say you need to update your browser or run a scan to continue.
- Do not install a cleaner or a second antivirus because an alert told you to.
- Do not run two real-time security programs at once.
Questions about URL:Blacklist
What is URL:Blacklist?
URL:Blacklist is the label Avast and AVG show when their Web Shield blocks a web address that is on Avast's blacklist. The window says Threat secured and that the connection to the address was aborted. It does not name an infected file, and nothing is moved to quarantine.
Avast does not publish the list or how an address gets onto it. An Avast employee described it in 2024 as plain malware, meaning addresses known to serve it, and said false positives can happen. The address named is the one that was stopped, and it may be a domain loaded by a page and not the page you typed.
Is URL:Blacklist a virus?
No, it is not a virus or a file, although it can point to one. Our 2020 guide called it a malware detection notification that is mostly false. The alert reports that a web address was blocked.
If the address served malware or came from adware on the PC, the risk is real. If a normal site was listed by mistake, the only cost is that it will not open.
Check the address, look at your installed programs and extensions, and report a suspected false positive to Avast. A scan from another tool is useful only when the alert keeps coming back without you browsing.
Is URL:Blacklist a false positive?
It can be, but the alert alone cannot say so. In 2020 Avast employees removed a listing after reports, and the threads of 2021 and 2024 show sites blocked and cleared again. In another 2020 case the block was caused by a redirect to a malicious site from a normal page.
Other tools finding nothing does not prove a false positive, because Avast checks websites live and does not show up in VirusTotal's website results. Report the address to Avast and wait for the answer. Only the Avast virus team can remove an entry or call it a false positive.
Why does Avast keep blocking a site with URL:Blacklist?
Because the address, or something the page loads, is on Avast's list, and the list changes only when the Avast virus team changes it. A user in April 2024 wrote that a site was removed and then listed again, and that more sites were blocked than he could report.
The block can also be caused by an ad domain or a redirect on the page, not by the site's own files. The same site may be blocked on one language version and not on another, as the 2020 case showed. A report with the exact blocked address gives Avast the most to work with.
How do I remove URL:Blacklist?
There is nothing to remove for the alert itself, because the connection was already stopped. Remove what may be behind it instead if the alert keeps returning without you browsing, or comes with pop-ups and redirects.
Run a Microsoft Defender Offline scan under Windows Security, uninstall programs you did not choose under Installed apps, remove unknown browser extensions and reset the browser that showed the alert. Our 2020 guide advised a browser reset and a scan with a second tool, and both still make sense. Do not download a removal tool because a pop-up says so.
Can I add the site as an exception?
You can, but it is the last choice. Avast's support says to open the menu, go to Settings, General, Exceptions and click Add exception, and to add a website only when you fully trust it, because exceptions reduce protection. We read that as a search excerpt and did not test it.
One user in 2020 wrote that an exception did not stop this block. If the site is your own and you think the listing is wrong, report it first. An exception hides a real threat as well as a false one.
How do I report a false positive to Avast?
Use Avast's false positive form, or post the exact address in the Avast Community forum, where Avast employees have answered such reports. In 2020 a volunteer linked the form for a suspected false positive on a file or website.
Give the full blocked address, the time and what you were doing. A volunteer said replies usually come within 48 hours, which is a volunteer's estimate and not an Avast promise. Only Avast team members can unblock an address, so keep Avast switched on while you wait.
Why does VirusTotal show nothing when Avast blocks the site?
Because Avast is not one of the engines that check a website on VirusTotal. An Avast Community leader wrote in April 2024 that Avast only does live scans of websites, not on-demand scans, so it does not appear in the VirusTotal results for a site.
A clean VirusTotal page therefore does not clear what Avast listed. It also does not convict the site, because one engine's listing can be a false positive. Use VirusTotal and a site scanner as clues, and read the blocked address in the Avast alert.
How is URL:Blacklist different from Botnet:Blacklist, URL:Mal and URL:Phishing?
URL:Blacklist, URL:Mal, URL:Phishing and URL:Scam are all Web Shield alerts for a blocked web address, with the name of the kind of listing after the colon. Botnet:Blacklist is different: it blocks a connection from a program on your PC to an IP address, and the Process line then names the program.
That one points at a program, and URL:Blacklist points at a web address. Our guides on the two cover them separately. Read the line that shows the address or the process in the alert first, then pick the guide that fits.
Will Fortect remove URL:Blacklist?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For URL:Blacklist, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Avast Community: How to remove: URL: Blacklist? (August 2020 to June 2024) (read October 6, 2026)
- Avast Community: Turn off all URL:(threat) without disabling actual malware/virus threat protect (January 2024) (read October 6, 2026)
- Avast Community: Avast Web Shield unusable on video sharing sites (April 2024) (read October 6, 2026)
- Avast Support: Exclude certain files or websites from scanning in Avast Antivirus (search excerpt only) (read October 6, 2026)
- Avast Support: Troubleshooting website access issues caused by Avast Antivirus (search excerpt only) (read October 6, 2026)
- Google Chrome Help: Reset Chrome settings to default (no longer online) (read October 6, 2026)
- Mozilla Support: Refresh Firefox - reset add-ons and settings (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- GitHub: iorate/ublacklist, Blocks specific sites from appearing in Google search results (read October 14, 2026)