Thread: QR Virus warning?

Originally Posted by richd97

Is anyone else's antivirus software giving them a warning when they visit QR? It just started happening to me, in both IE & Firefox, and it isn't happening to me on any other sites(so far)

I don't know if this is the same thing or not, but I had this happening to me for about a month and it was mostly in the "games" and "trivia" sections. There would be a banner ad that would pop up at the top of the page and my antivirus software would block it. I wrote to QR about this but they didn't know why it was happening to me and said that they hadn't heard from anyone else having this problem. It all of a sudden stopped about a week ago.

Richd97, is it still happening?

I didn't see any ad banners at all on QR this morning. Did you? And if so, where did you see one?

What virus checker are you running? Norton? AVG?

I'm using CA Antivirus. It seems to only be happening on the sign-in page & the homepage. It has something to do with a javascript on the those pages.

I just went through the entire site and had no problem. Hope that's cleared up.

Have a Blessed weekend.

I think it came from that wonderful new search engine,local.com .


I saved a hijackthis log.


The reg entries were so new......probably a trojan........that they produced 0 google results at the time.

I turned the clock back to the previous day,and that seemed to fix it.

I had thought that it was the most recent windows update,the daylight savings/world clock thing.......and maybe that did create an exploit,but I do NOT have that windows update any longer,AND I do not have a spyware/trojan problem.....I'm pretty sure.


And,as you can see,I have very few unnecessary programs running automatically continuously :




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:26:02 PM, on 5/26/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (x.xx.xxxx.xxxx)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\DOCUME~1\xxxxxxx~1\LOCALS~1\Temp\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\XXXXXXX\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {xxxxxxx-Axx5-4xxb-BC74-9C2xxxxxxx9** - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7xxxxx1-17CE-4C07-BC86-EAxxxxx69C** - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime





O4 - HKLM\..\Run: [Fjulubadero] rundll32.exe "C:\WINDOWS\iheyesogufutuf.dll",Startup

O4 - HKCU\..\Run: [Bhiwe] rundll32.exe "C:\WINDOWS\msti32.dll",Startup





O9 - Extra button: (no name) - {Cxxxxxx0-D8E9-11d2-98FE-00C0xxxxxxFE** - (no file)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 1503 bytes

Why do you think it was local.com that caused the virus warning? I do that one every day on QR for the one cent and haven't noticed any alarms or warnings.

It seems to have started after the most recent virus definitions for my software downloaded yesterday. I'm waiting for the next definition update to be released to see if that fixes it. I had a similar problem a while back that was happening on many sites, and when I updated the definitions it stopped.

I never had that problem until about 30 minutes ago. I have CA for anti virus program. I had no problems doing the games or trivia or clicks. I then went o the home page and got the message I was not logged in and as I was about to login, I got the virus warning.

I emailed QR and this is their response:

Hi,
I will forward this to the tech. There are no viruses on our site. There
isn't any banners on our site to cause this. It must be an issue with the
CA software. This happened to thier software before. None of the other
softwares (Norton and so on) are getting this error. Once they do the next
upgrade this message will fix. I can assure you there isn't anything wrong
on our site.
Thanks,
QR


I am still getting that trojan msg