Is This A Potential Site Infection ?

[Mooly]

Confronted with this on the home page. Possible site problem ?

[Raistlin]

No problems here,

Detecting and Removing a Computer Virus

­Antivirus software is practically a requirement for anyone using the Windows. While it's true you can avoid viruses if you practice safe habits, the truth is that the people who write computer viruses are always looking for new ways to infect machines.

There are several different antivirus programs on the market -- some are free and some you have to purchase. Keep in mind that free versions often lack some of the nicer features you'll find in commercial products.

Let's start with the assumption that you're able to run antivirus software.

Assuming your antivirus software is up to date, it should detect malware on your machine. Most antivirus programs have an alert page that will list each and every virus or other piece of malware it finds. You should write down the names of each malware application your software discovers.

Many antivirus programs will attempt to remove or isolate malware for you. You may have to select an option and confirm that you want the antivirus software to tackle the malware. For most users, this is the best option -- it can be tricky removing malware on your own.

If the antivirus software says it has removed the malware successfully, you should shut down, reboot and run the antivirus software again.

This time, if the software comes back with a clean sweep, you're good to go.

If the antivirus software finds different malware, you may need to repeat the previous steps. If it finds the same malware as before, you might have to try something else.

[Cyker]

It may be a rogue advert or you have a browser advert hijacker on your compy! :D

[Raistlin]

WHAT IS A BROWSER HIJACKER?

A browser hijacker is a malicious program, usually a web browser plug-in that modifies web browser settings in order to change default home, search or error page and redirect a user to undesirable Internet sites.

A browser hijacker also can record all web pages the user visits and send gathered information out through a background Internet connection. Practically all browser hijackers are created for commercial, advertising or marketing purposes.

Most parasites are very similar to spyware or adware threats and often have some of their functions.

They are installed without explicit user consent and often attempt to obstruct their removal.

All browser hijackers are harmful and therefore are always classified as security and privacy risks

HOW TO REMOVE A BROWSER HIJACKER?

As it was said above most browser hijackers are quite similar to spyware and adware threats and therefore cannot be removed with the help of popular antivirus products.

To remove them special anti-spyware tools (spyware removers) should be used.

These programs scan the system in similar way as antivirus software does. However, they have special parasite signature databases, which allow them to detect and eliminate most privacy risks.

Powerful spyware removers include real-time monitors that prevent the installation of known risks and unauthorized system modification.

The most effective and popular anti-spyware programs are Microsoft AntiSpyware Beta, Spyware Doctor, Spybot - Search & Destroy, Ad-Aware SE, SpyHunter, eTrust PestPatrol. Several products such as HijackThis or CWShredder are designed especially to detect and remove browser hijackers.

In some cases even a spyware remover can fail to get rid of a particular parasite.

That is why there are Internet resources such as 2-Spyware.com, which provide manual malware removal instructions. These instructions allow the user to manually delete all the files, directories, registry entries and other objects that belong to a parasite.

However, manual removal requires fair system knowledge and therefore can be a quite difficult task for novices.

[Mooly]

^{Thanks for the replies. I'm fairly sure its not a problem this (my) end (todays visit here was the first time I have seen the message and it appeared the instant the home page appeared). I haven't seen it this evening on the site so far.}

^{Security is something I do take seriously and nothing untoward has shown up. As well as normal security measures I also have a very comprehensive backup routine such that I can revert the whole system back to any day in the last 28 and any month in the last year. I can also load an image with various security suites and check the working image is clean if there were any doubt whatsoever.}

^{If it happens again then obviously I'll post here.}

[Cyker]

When in doubt, download Malwarebytes Anti-Malware, install, update, run a quick scan - It's really good and free for personal use. I use it to mop up infected teacher laptops fairly frequently and it's proven much better at removing crapware than any anti-virus program.

Sadly it doesn't prevent infections in the first place unless you buy the resident module, 'tho it's worth the money IMHO.

[Mooly]

Thanks :) It is a program I'm familiar with.

If I had any doubt my end I would image the system as it stands and then scan it with the likes of MB, ESET and FSecure etc. I'd use the full product versions as a trial.

I've been here before... and the system has always come back clean. The problem has always been elsewhere. The last time was on a well known PC Advisor site of all places.

If anything untoward shows or if I see the problem on any other site etc in the immediate future then I will of course report back here.

[Mooly]

Different PC, different OS, different browser version. This was Vista and IE9. Yesterday I was on W7 x64 running IE10 in 64 bit mode.

[FROSTYBALLS]

I had the same yesterday.

Similar Windows/IE set up as Mooly, and have Malwares Anti-Malware Pro and Microsoft Security Essentials installed - my system is clean.

[Raistlin]

The error message says its an add on so local to your PC, have you checked them.

The only change I can see to the forum is the addition of: Have something to contribute? Reply to this discussion

Maybe there is something clashing with this new additional script ???

[Mooly]

Curiosity got the better of me. I imaged the system as it stood and then un-installed my normal security (Microsoft MSE) and installed Malwarebytes. Following a full scan with MB I then installed a full version of the latest F-Secure security suite.

Results as shown.

[Mooly]

It appeared on this page just now. Had to refresh this page twice to get a normal advert to appear. Over to you folks now I guess...

[Raistlin]

Start>Control Panel>Programs and Features>locate any software published by Conduit and uninstall it from your computer.

If not do this:

Install, update, and run these programs in this order. (Not all programs detect the same Malware, so you may need to run them all to solve your problem.)

These programs are all free for personal use, but some have limited functionality in the "free mode" - but those are features you really don't need to find and remove the problem that you have.
Note: If your Malware infection is bad enough and you are mis-directed to URL's other than what is posted, you may have to use a different PC to download these programs and use a USB stick to transfer them to the afflicted PC.

Malwarebytes' Anti-Malware - http://www.malwarebytes.org/mbam.php

SuperAntispyware - http://www.superantispyware.com/

AdAware - http://www.lavasoftusa.com/software/adaware/

Spybot Search & Destroy - http://www.safer-networking.org/en/index.html

Windows Defender: Home Page - http://windows.microsoft.com/en-US/wi.../windows-defender

Also, if you have a search engine re-direct problem, see this:
http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html

Many viruses and such, as long as they are able to startup, are pretty effective at avoiding those scan/removal programs. By booting into "Safe Mode", windows only allows it's core components to load.

To boot into safe mode, press "F8" as the computer is booting up and select "Safe Mode" from the menu. Because the desktop will be larger than the monitor under "Safe Mode", the icon might end up off of the screen. You can still select the program through the "Start"/"All Programs" menu, or simply place the icon in the lower left corner of your desktop after installing it in normal mode.

If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:

http://www.spywarewarrior.com/index.php

http://forum.aumha.org/

http://www.spywareinfoforum.com/

http://bleepingcomputer.com

[Mooly]

Thanks Raistlin, I appreciate all you say but I've already run three separate scans (MSE, FSecure and Malwarebytes) and all come back 100% clean. This is the only site out of very many that currently exhibits this (admittedly random) behaviour. And more than that, its done it on both my PC's today. There is no suspicious behaviour, no redirects, no unexpected processes running on either PC.

Frosty mentioned seeing the same too,

http://www.toyotaownersclub.com/forums/topic/152279-is-this-a-potential-site-infection/?p=1294152

[Uncle Buck]

You're not the only one Mooly - I had it appear & after several sweeps using 2 different progs, my pc is clean too.

[Cyker]

Prolly a rogue advert in the ad banner; Don't know if you can deselect certain ads or report rogue ads to your ad provider...?

[FROSTYBALLS]

Yes I had it appear yesterday - though not today. Had scheduled scans run late yesterday using Malwarebytes Anti-Malware Pro and MS Security Essentials (and Security Essentials found one Exploit virus and it was deleted). Have run two separate scans today using both programs, nothing found.