Wilders Security Forums  

Go Back   Wilders Security Forums > Official ESET Support Forum > ESET Home Users Products Forum > ESET NOD32 Antivirus
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread
  #1  
Old May 21st, 2012, 09:51 AM
Echofig Echofig is offline
Infrequent Poster
 
Join Date: Jun 2009
Posts: 10
Default Address has been blocked

When going to www.msn.com users are getting a prompt. Address has been blocked. Version 4.2.76.0 Update 7155.
  #2  
Old May 21st, 2012, 09:59 AM
ramirez1 ramirez1 is offline
Infrequent Poster
 
Join Date: Sep 2010
Posts: 30
Default Re: Address has been blocked

Quote:
Originally Posted by Echofig
When going to www.msn.com users are getting a prompt. Address has been blocked. Version 4.2.76.0 Update 7155.

I'm running the same version and I don't have any problems. Any more details on the message?
  #3  
Old May 21st, 2012, 10:09 AM
Echofig Echofig is offline
Infrequent Poster
 
Join Date: Jun 2009
Posts: 10
Default Re: Address has been blocked

This is the address that is in the popup. No reason for block stated.

b.scorecardresearch.com/b?c1=2c2=3000001c7=http://www.msn.com/c9=rn=1337607384423

98.174.29.211:80
  #4  
Old May 21st, 2012, 10:22 AM
ramirez1 ramirez1 is offline
Infrequent Poster
 
Join Date: Sep 2010
Posts: 30
Default Re: Address has been blocked

Quote:
Originally Posted by Echofig
This is the address that is in the popup. No reason for block stated.

b.scorecardresearch.com/b?c1=2c2=3000001c7=http://www.msn.com/c9=rn=1337607384423

98.174.29.211:80

Actually scorecardresearch.com is being blocked by ESET today. I saw it on a few websites.
  #5  
Old May 21st, 2012, 10:25 AM
devicegrip devicegrip is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 6
Default Re: Address has been blocked

I am also getting this address being blocked. If I open IE with 7 different home pages, the pop-up shows up for each one of them (most of them at least). I tried installing firefox and using the same websites I get the pop-up. These same home-pages work fine on another computer, so installing firefox does not resolve the issue. Running malwarebytes and housecall online virus scan do not pick up anything.

NOD blocks the redirects etc, but does not get the actual virus causing the issue.
  #6  
Old May 21st, 2012, 10:35 AM
ramirez1 ramirez1 is offline
Infrequent Poster
 
Join Date: Sep 2010
Posts: 30
Default Re: Address has been blocked

Mine is showing HTML/ScrInject.B.Gen virus
  #7  
Old May 21st, 2012, 10:35 AM
djackino djackino is offline
Infrequent Poster
 
Join Date: Oct 2010
Posts: 45
Default Re: Address has been blocked

Quote:
Originally Posted by Echofig
This is the address that is in the popup. No reason for block stated.

b.scorecardresearch.com/b?c1=2c2=3000001c7=http://www.msn.com/c9=rn=1337607384423

98.174.29.211:80

That's one of the ones I am seeing too (along with a.scorecardresearch) on Washington DC all-news radio website.
  #8  
Old May 21st, 2012, 10:47 AM
ramirez1 ramirez1 is offline
Infrequent Poster
 
Join Date: Sep 2010
Posts: 30
Default Re: Address has been blocked

a few minutes ago ESET was also blocking the main site for me.

scorecardresearch.com is now working. Other sites that were blocked are now accessible.

Running v4.2.76.0 Update 7155 (20120521)
  #9  
Old May 21st, 2012, 10:57 AM
pyrobane pyrobane is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 3
Default Re: Address has been blocked

I'm seeing alerts for b.scorecardresearch.com as well. They seem to be referencing a beacon.js file.

My clients are also seeing the HTML/ScrInject.B.Gen virus threat show up on sites like cnet.com and wordpress.com.

This happens with 4.2.71 (7155).
  #10  
Old May 21st, 2012, 10:58 AM
devicegrip devicegrip is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 6
Default Re: Address has been blocked

Did you guys get a screen pop-up that looked like a legit microsoft notification saying that your computer is infected with 87 viruses, please click here to remove.... (not exact wording but you get the point).

The user on my system that has this virus reported that pop-up over the weekend and now is getting the site being blocked by NOD. Why is NOD not removing the HTML/ScrInject.B.Gen virus? I even reset internet explorer and all settings. If anyone finds a removal method, please post.
  #11  
Old May 21st, 2012, 11:03 AM
devicegrip devicegrip is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 6
Default Re: Address has been blocked

I did notice that once I open IE for the first time, the very first site NOD blocks is scorecardresearch.com./<??>.js ... Then it proceeds to block most other redirects.

I can't remember the .js file that it blocks (not currently connected to the machine), but maybe someone else is getting the same message. beacon.js could be the file name, but it doesn't look familiar.
  #12  
Old May 21st, 2012, 11:33 AM
pyrobane pyrobane is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 3
Default Re: Address has been blocked

Quote:
Originally Posted by devicegrip
Did you guys get a screen pop-up that looked like a legit microsoft notification saying that your computer is infected with 87 viruses, please click here to remove.... (not exact wording but you get the point).

One user here reported a similar pop-up but I wasn't able to see it. User restarted and wasn't able to reproduce it.
  #13  
Old May 21st, 2012, 11:36 AM
Marcos Marcos is offline
Eset Moderator
 
Join Date: Nov 2002
Posts: 14,193
Default Re: Address has been blocked

The above mentioned site was removed from blacklist 1,5 hours before this thread was started.
  #14  
Old May 21st, 2012, 11:38 AM
pyrobane pyrobane is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 3
Default Re: Address has been blocked

I've not seen any additional instances of this happening since about that time. Thanks for the response.
  #15  
Old May 21st, 2012, 11:51 AM
devicegrip devicegrip is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 6
Default Re: Address has been blocked

I just got a second person reporting the
"antivirus has blocked the following:
b.scorecardresearch.com/beacon.js ip 204-141.87.16:80"

IP address being blocked by NOD. Do you think a reboot will fix this?
  #16  
Old May 21st, 2012, 12:23 PM
Marcos Marcos is offline
Eset Moderator
 
Join Date: Nov 2002
Posts: 14,193
Default Re: Address has been blocked

After running an update, it won't be detected. Strange that the block is still reported even though it was fixed in a module update about 4 hours ago.
  #17  
Old May 21st, 2012, 12:56 PM
devicegrip devicegrip is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 6
Default Re: Address has been blocked

Is this a false positive and there is nothing to worry about? I have over 400 NOD clients and only 2 have reported this issue so far, which leads me to believe they have a virus of some sort.
  #18  
Old May 21st, 2012, 01:33 PM
devicegrip devicegrip is offline
Infrequent Poster
 
Join Date: May 2012
Location: USA
Posts: 6
Default Re: Address has been blocked

Reboot fixed both of my clients with the issue. Thanks for the help Marcos.
 

Wilders Security Forums > Official ESET Support Forum > ESET Home Users Products Forum > ESET NOD32 Antivirus « Previous Thread | Next Thread »

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Settings
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 05:14 PM.


Powered by vBulletin® Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2013, Wilders Security Forums