Address has been blocked

When going to www.msn.com users are getting a prompt. Address has been blocked. Version 4.2.76.0 Update 7155.

 

I'm running the same version and I don't have any problems. Any more details on the message?

 

This is the address that is in the popup. No reason for block stated.

b.scorecardresearch.com/b?c1=2c2=3000001c7=http://www.msn.com/c9=rn=1337607384423

98.174.29.211:80

 

Actually scorecardresearch.com is being blocked by ESET today. I saw it on a few websites.

 

I am also getting this address being blocked. If I open IE with 7 different home pages, the pop-up shows up for each one of them (most of them at least). I tried installing firefox and using the same websites I get the pop-up. These same home-pages work fine on another computer, so installing firefox does not resolve the issue. Running malwarebytes and housecall online virus scan do not pick up anything.

NOD blocks the redirects etc, but does not get the actual virus causing the issue.

 

Mine is showing HTML/ScrInject.B.Gen virus

 

That's one of the ones I am seeing too (along with a.scorecardresearch) on Washington DC all-news radio website.

 

a few minutes ago ESET was also blocking the main site for me.

scorecardresearch.com is now working. Other sites that were blocked are now accessible.

Running v4.2.76.0 Update 7155 (20120521)

 

I'm seeing alerts for b.scorecardresearch.com as well. They seem to be referencing a beacon.js file.

My clients are also seeing the HTML/ScrInject.B.Gen virus threat show up on sites like cnet.com and wordpress.com.

This happens with 4.2.71 (7155).

 

Did you guys get a screen pop-up that looked like a legit microsoft notification saying that your computer is infected with 87 viruses, please click here to remove.... (not exact wording but you get the point).

The user on my system that has this virus reported that pop-up over the weekend and now is getting the site being blocked by NOD. Why is NOD not removing the HTML/ScrInject.B.Gen virus? I even reset internet explorer and all settings. If anyone finds a removal method, please post.

 

I did notice that once I open IE for the first time, the very first site NOD blocks is scorecardresearch.com./<??>.js ... Then it proceeds to block most other redirects.

I can't remember the .js file that it blocks (not currently connected to the machine), but maybe someone else is getting the same message. beacon.js could be the file name, but it doesn't look familiar.

 

One user here reported a similar pop-up but I wasn't able to see it. User restarted and wasn't able to reproduce it.

 

The above mentioned site was removed from blacklist 1,5 hours before this thread was started.

 

I've not seen any additional instances of this happening since about that time. Thanks for the response.

 

I just got a second person reporting the
"antivirus has blocked the following:
b.scorecardresearch.com/beacon.js ip 204-141.87.16:80"

IP address being blocked by NOD. Do you think a reboot will fix this?

 

After running an update, it won't be detected. Strange that the block is still reported even though it was fixed in a module update about 4 hours ago.

 

Is this a false positive and there is nothing to worry about? I have over 400 NOD clients and only 2 have reported this issue so far, which leads me to believe they have a virus of some sort.

 

Reboot fixed both of my clients with the issue. Thanks for the help Marcos.