virus Bangkok Post website ?

[Duvel]

Since last Monday 2^nd July 2012 my virus scanner ESET Smart Security disconnects the website of Bangkok Post each time I try to connect to http://www.bangkokpost.com/ .

More details:

HTTP filter

HTML/ScrInject.B.Gen virus

connection terminated - quarantined

Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

Did anybody else experience similar problems ?

What is the cause and what is the risk ?

[CyberPro]

Since last Monday 2^nd July 2012 my virus scanner ESET Smart Security disconnects the website of Bangkok Post each time I try to connect to http://www.bangkokpost.com/ .

More details:

HTTP filter

HTML/ScrInject.B.Gen virus

connection terminated - quarantined

Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

Did anybody else experience similar problems ?

What is the cause and what is the risk ?

 

I can connect to http://www.bangkokpost.com/ just fine using the Google Chrome browser. In my opinion, one can expect Google to be more proactive about updating the browser than IE. I only use IE for those sites that require it.

 

Following are some links to ScrInject.B.Gen virus. In a brief web search I didn't find this term in Symmantec or Norton discussions. If it were common malware, Symmantec and Norton would have discussion. Regarding the below, don't believe everything you read by so called security experts not assoicated with trusted vendors. Hope that helps.

 

http://www.google.com/webhp?sourceid=chrome-instant&ie=UTF-8#hl=en&output=search&sclient=psy-ab&q=Symmantec%20ScrInject.B.Gen&oq=&gs_l=&pbx=1&fp=e757a35b73c411c2&bav=on.2,or.r_gc.r_pw.r_qf.,cf.osb&biw=1083&bih=809

[constructorbigt]

working just fine for me i use everyday

[Duvel]

working just fine for me i use everyday

For me it always worked too, until Monday 2^nd July 2012 evening.

Which virus scanner do you use ?

Are you also in Thailand ?

[Duvel]

working just fine for me i use everyday

Sorry, answering wrong post.

Edited July 5, 2012 by Duvel

[CyberPro]

Since last Monday 2^nd July 2012 my virus scanner ESET Smart Security disconnects the website of Bangkok Post each time I try to connect to http://www.bangkokpost.com/ .

More details:

HTTP filter

HTML/ScrInject.B.Gen virus

connection terminated - quarantined

Threat was detected upon access to web by the application: C:\Program Files\Internet Explorer\iexplore.exe.

Did anybody else experience similar problems ?

What is the cause and what is the risk ?

 

PS: It's possible, although unlikely, that the URL http://www.bangkokpost.com/ was hijacked temporarily and redirected to a malware site. To be safer, one would apply Microsoft (if using a PC) security patches monthly including the basic malware check, use a browser that updates for security problems (Google Chrome), install and run Microsoft's Baseline Security Analyzer (MBSA), same for Malwarebytes and Ad-Aware, use a respected antivirus product (many think Kapersky is best), avoid the temptation to visit untrusted web sites. If you have a rootkit or trojan, which would probably not happen if the above precautions were taken, a disk reformat and operating system reinstall would be the most severe recovery, at least in the case of a rootkit. Try accessing that site using a different browser first. Obviously update for security patches and antivirus first.

[Duvel]

I can connect to http://www.bangkokpost.com/ just fine using the Google Chrome browser. In my opinion, one can expect Google to be more proactive about updating the browser than IE. I only use IE for those sites that require it.

 

Following are some links to ScrInject.B.Gen virus. In a brief web search I didn't find this term in Symmantec or Norton discussions. If it were common malware, Symmantec and Norton would have discussion. Regarding the below, don't believe everything you read by so called security experts not assoicated with trusted vendors. Hope that helps.

 

http://www.google.co...iw=1083&bih=809

When I google I find a lot about ScrInject.B.Gen virus.

I use Internet Explorer 9 without problems, but I guess that a harmful virus will be harmful with any internet browser.

Which virus scanner do you use ?

Are you also in Thailand ?

[Duvel]

PS: It's possible, although unlikely, that the URL http://www.bangkokpost.com/ was hijacked temporarily and redirected to a malware site. To be safer, one would apply Microsoft (if using a PC) security patches monthly including the basic malware check, use a browser that updates for security problems (Google Chrome), install and run Microsoft's Baseline Security Analyzer (MBSA), same for Malwarebytes and Ad-Aware, use a respected antivirus product (many think Kapersky is best), avoid the temptation to visit untrusted web sites. If you have a rootkit or trojan, which would probably not happen if the above precautions were taken, a disk reformat and operating system reinstall would be the most severe recovery, at least in the case of a rootkit. Try accessing that site using a different browser first. Obviously update for security patches and antivirus first.

I’ve had the problem several (eight up to now) times, from Monday 02/07/2012 23:10:58 until today Thursday 05/07/2012 18:08:56 (local Thai time).

This doesn’t look like something temporary.

I run all Microsoft and ESET updates.

I’ve had Norton, McAfee, Kaspersky and bitdefender in the past, but I didn’t like them.

I avoid “shady” websites.

I’ve no problems with other websites and it looks as if it is a Bangkok Post thing.

[CyberPro]

When I google I find a lot about ScrInject.B.Gen virus.

I use Internet Explorer 9 without problems, but I guess that a harmful virus will be harmful with any internet browser.

Which virus scanner do you use ?

Are you also in Thailand ?

 

There are many web entries regarding ScrInject.B.Gen virus, but I see none from AV vendors' knowledge bases.

I'm using Symmantec AV and am in the US. Location should not matter for an AV alert.

Using IE Ver 7, http://www.bangkokpost.com/ loads although slowly. Same with Firefox 2.6 and Opera 11.10.

re Ad-Aware. I see user reviews are mixed for the newer version. Most reviews are positive. http://download.cnet.com/Ad-Aware-Free-Antivirus/3000-8022_4-10045910.html

[CyberPro]

I’ve had the problem several (eight up to now) times, from Monday 02/07/2012 23:10:58 until today Thursday 05/07/2012 18:08:56 (local Thai time).

This doesn’t look like something temporary.

I run all Microsoft and ESET updates.

I’ve had Norton, McAfee, Kaspersky and bitdefender in the past, but I didn’t like them.

I avoid “shady” websites.

I’ve no problems with other websites and it looks as if it is a Bangkok Post thing.

 

If your problem results from your location, and no one near you can repeat the problem, you can try a proxy server. I volunteered to set up a proxy server this summer for a group teaching in a location where uTube, etc are blocked but haven't gotten around to it yet. The below link may help.

 

http://www.google.com/webhp?sourceid=chrome-instant&ie=UTF-8#hl=en&gs_nf=1&gs_mss=http%3A%2F%2Fwww.bangkokpost.com%20access%20problem&pq=http%3A%2F%2Fwww.bangkokpost.com%20access%20problems&cp=11&gs_id=3p&xhr=t&q=free+proxy+server&pf=p&sclient=psy-ab&oq=free+proxy+&gs_l=&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.,cf.osb&fp=e757a35b73c411c2&biw=1083&bih=809

[Duvel]

There are many web entries regarding ScrInject.B.Gen virus, but I see none from AV vendors' knowledge bases.

I'm using Symmantec AV and am in the US. Location should not matter for an AV alert.

Using IE Ver 7, http://www.bangkokpost.com/ loads although slowly. Same with Firefox 2.6 and Opera 11.10.

re Ad-Aware. I see user reviews are mixed for the newer version. Most reviews are positive. http://download.cnet...4-10045910.html

Internet Explorer 7 is VERY old; I cannot even remember when I upgraded to versions 8 and 9.

I don’t want to overcharge my notebook with too many internet browsers.

[CyberPro]

Internet Explorer 7 is VERY old; I cannot even remember when I upgraded to versions 8 and 9.

I don’t want to overcharge my notebook with too many internet browsers.

 

Ahh..notebook. Got it. You can try the Google browser and uninstall it if you don't like it. Try connecting from an internet cafe. If that works you know it's not your location. If you are comfortable disabling your antivirus just long enough to test connecting to that site, that's an possibility. I only would do this for testing and rarely if ever then. Yes, IE 7 is old. Ever notice how Micros$oft tends to make their desktop products worse with each upgrade? Just joking. ;)

[Duvel]

Ahh..notebook. Got it. You can try the Google browser and uninstall it if you don't like it. Try connecting from an internet cafe. If that works you know it's not your location. If you are comfortable disabling your antivirus just long enough to test connecting to that site, that's an possibility. I only would do this for testing and rarely if ever then. Yes, IE 7 is old. Ever notice how Micros$oft tends to make their desktop products worse with each upgrade? Just joking. ;)

There might be a link with the spyware/malware/adware (doubleclick.net et al.) I blocked:

http://www.wilderssecurity.com/showthread.php?t=317320

I’m not an expert in PC’s and I don’t understand everything I read.

[CyberPro]

Internet Explorer 7 is VERY old; I cannot even remember when I upgraded to versions 8 and 9.

I don’t want to overcharge my notebook with too many internet browsers.

 

One more thought (OK two): Your problem is probably not browser-based and the website is probably not infected...IF you are connecting to the website you think you are. The DNS server you are using tells your notebook where to find a given web site. DNS servers can be hijacked. This is usually a temporary problem and rarely occurs.

 

http://www.ateamsystems.com/blog/How-Does-My-Computer-Find-A-Website-Registrars-DNS-Servers-And-Web-Servers-Relationships-Explained

[CyberPro]

There might be a link with the spyware/malware/adware (doubleclick.net et al.) I blocked:

http://www.wildersse...ad.php?t=317320

I’m not an expert in PC’s and I don’t understand everything I read.

 

So you are blocking certain website/actions in Internet Explorer, ie "Re: doubleclick.net causing HTML/ScrInject.B.Gen virus alerts"?

 

It's hard to decide what to allow because the messages prompting you to accept/deny are not helpful unless you know the consequences of allowing the site they are referring to. Another reason not to use IE. Micro$oft went from no browser security to such annoying security that I usually only use IE long enough to download Google Chrome or less often, Firefox (and for security updates). Grrrrr

Edited July 5, 2012 by CyberPro

[Duvel]

Ahh..notebook. Got it. You can try the Google browser and uninstall it if you don't like it. Try connecting from an internet cafe. If that works you know it's not your location. If you are comfortable disabling your antivirus just long enough to test connecting to that site, that's an possibility. I only would do this for testing and rarely if ever then. Yes, IE 7 is old. Ever notice how Micros$oft tends to make their desktop products worse with each upgrade? Just joking. ;)

As to my notebook: It’s an Acer Aspire 4925G with an American-Thai keyboard I bought end 2008, shortly after our arrival in Thailand.

In general I’m happy with it, but it has a memory of 2GB only.

(When I bought it, most of the other notebooks available in Thailand had a memory of 1 GB only.)

I wonder if it is worth the trouble to have the memory upgraded to 4 GB.

[Duvel]

One more thought (OK two): Your problem is probably not browser-based and the website is probably not infected...IF you are connecting to the website you think you are. The DNS server you are using tells your notebook where to find a given web site. DNS servers can be hijacked. This is usually a temporary problem and rarely occurs.

 

http://www.ateamsyst...ships-Explained

The problem is lasting for nearly 3 days now.

I can’t imagine the hijacking of a DNS server to go unnoticed for such a long time.

[CyberPro]

As to my notebook: It’s an Acer Aspire 4925G with an American-Thai keyboard I bought end 2008, shortly after our arrival in Thailand.

In general I’m happy with it, but it has a memory of 2GB only.

(When I bought it, most of the other notebooks available in Thailand had a memory of 1 GB only.)

I wonder if it is worth the trouble to have the memory upgraded to 4 GB.

 

"The problem is lasting for nearly 3 days now.

I can’t imagine the hijacking of a DNS server to go unnoticed for such a long time."

 

Agreed

 

I nearly bought an Acer Aspire myself, and may still buy something similar for use while flying. Are you running WIndows XP? 2 GB of RAM should be fine for XP. You can open Windows Performance Monitor (hit ctr-alt-del and choose Task Manager/Performance) to check memory usage. I suspect you aren't using much of your RAM.

 

Did some action immediately precede your inability to access this website? ie a popup in IE asking to accept/deny something, perhaps doubleclick.net? Again, installing another web browser for testing would rule out an issue specific to IE. If I'm building web pages I switch between browsers as needed. Sometimes a modification won't display correctly in one browser due to cache retention, etc, while in another it will.

Edited July 5, 2012 by CyberPro

[Duvel]

"The problem is lasting for nearly 3 days now.

I can’t imagine the hijacking of a DNS server to go unnoticed for such a long time."

 

Agreed

 

I nearly bought an Acer Aspire myself, and may still buy something similar for use while flying. Are you running WIndows XP? 2 GB of RAM should be fine for XP. You can open Windows Performance Monitor (hit ctr-alt-del and choose Task Manager/Performance) to check memory usage. I suspect you aren't using much of your RAM.

 

Did some action immediately precede your inability to access this website? ie a popup in IE asking to accept/deny something, perhaps doubleclick.net? Again, installing another web browser for testing would rule out an issue specific to IE. If I'm building web pages I switch between browsers as needed. Sometimes a modification won't display correctly in one browser due to cache retention, etc, while in another it will.

My Acer Aspire 4925G came with Windows Vista Home Premium installed.

It had “802.11a/b/g/Draft-N WLAN” on it; wireless “N” works fine now.

It also contained a lot of games and other unnecessary software that I removed.

On the keyboard there are some flashing blue lights (“hard disk active”, etc.) that irritate me and that I cover with a piece of paper.

I use the notebook with an external USB mouse and a cheap microphone (for Skype).

Windows Sidebar shows me that I’m always using more than 50 % of my memory.

At this moment Windows Task Manager tells me I’m using 1.49 GB of Physical Memory.

Some pictures:

[CyberPro]

My Acer Aspire 4925G came with Windows Vista Home Premium installed.

It had “802.11a/b/g/Draft-N WLAN” on it; wireless “N” works fine now.

It also contained a lot of games and other unnecessary software that I removed.

On the keyboard there are some flashing blue lights (“hard disk active”, etc.) that irritate me and that I cover with a piece of paper.

I use the notebook with an external USB mouse and a cheap microphone (for Skype).

Windows Sidebar shows me that I’m always using more than 50 % of my memory.

At this moment Windows Task Manager tells me I’m using 1.49 GB of Physical Memory.

Some pictures:

 

Duvel: If you are OK with your current performance, I'd leave it alone. If you aren't then I'd consider more RAM. Vista was (in my opinion) a stop-gap release until Microsoft could finish all the enhancements they wanted to include with Windows 7. If Vista works for you, then leave it. 4 years is about the expected life span for a personal computer although if it's working, run it until it quits. My home office mid-tower computers will run any version of Windows, Linux, etc. A well-made laptop from work was "designed for WIndows 7", which I hated, so I installed Windows 2003 server (I seldom use desktop operating systems due to the added "fluff" features). Windows 2003 would boot but go to "blue screen", ie crash. You may be able to go up to Windows 7 or back to XP, or maybe not. If you are OK with the performance now, then leave it. If you are memory-restricted, add RAM. Additional memory may reduce writing to hard drive, ie annoying blue light (the computer uses the hard drive for temporary memory storage as needed). Before buying, check that your notebook supports more memory.

 

I now suspect your web site access issue has to do with IE settings. Is that lovely young blond child a family member? Lucky you. Best wishes.

Edited July 5, 2012 by CyberPro

[Duvel]

Duvel: If you are OK with your current performance, I'd leave it alone. If you aren't then I'd consider more RAM. Vista was (in my opinion) a stop-gap release until Microsoft could finish all the enhancements they wanted to include with Windows 7. If Vista works for you, then leave it. 4 years is about the expected life span for a personal computer although if it's working, run it until it quits. My home office mid-tower computers will run any version of Windows, Linux, etc. A well-made laptop from work was "designed for WIndows 7", which I hated, so I installed Windows 2003 server (I seldom use desktop operating systems due to the added "fluff" features). Windows 2003 would boot but go to "blue screen", ie crash. You may be able to go up to Windows 7 or back to XP, or maybe not. If you are OK with the performance now, then leave it. If you are memory-restricted, add RAM. Additional memory may reduce writing to hard drive, ie annoying blue light (the computer uses the hard drive for temporary memory storage as needed). Before buying, check that your notebook supports more memory.

 

I now suspect your web site access issue has to do with IE settings. Is that lovely young blond child a family member? Lucky you. Best wishes.

I intend to keep this notebook as long as I can.

In the past, apart from desktops, I’ve had a Compaq with Windows Millennium which I paid 4 times more than my current notebook and used for more than 7 years before it got “underpowered”.

Perhaps one day I buy a new more performing one and keep this one as a spare (and for the missus).

The only change I consider is to upgrade the memory from 2 GB to 4GB, which is the maximum this notebook supports.

(If I’m not mistaken a memory higher than 4 GB requires 64-bit software instead of 32-bit software.)

I’m not overly fond of Windows Vista, but I stripped it of its most annoying features, such as the “previews” when you hover the buttons in the taskbar.

The young girl in the picture is my oldest granddaughter ... four years ago.

[Duvel]

Back on topic.

The problem with the website http://www.bangkokpost.com/ of Bangkok Post is not yet resolved.

I’ve no problems with any other websites and I don’t want spyware/malware/adware on my notebook either.

So, I decided to change to the website http://www.nationmultimedia.com/ of The Nation, the other English language newspaper in Thailand.

[CyberPro]

I intend to keep this notebook as long as I can.

In the past, apart from desktops, I’ve had a Compaq with Windows Millennium which I paid 4 times more than my current notebook and used for more than 7 years before it got “underpowered”.

Perhaps one day I buy a new more performing one and keep this one as a spare (and for the missus).

The only change I consider is to upgrade the memory from 2 GB to 4GB, which is the maximum this notebook supports.

(If I’m not mistaken a memory higher than 4 GB requires 64-bit software instead of 32-bit software.)

I’m not overly fond of Windows Vista, but I stripped it of its most annoying features, such as the “previews” when you hover the buttons in the taskbar.

The young girl in the picture is my oldest granddaughter ... four years ago.

 

If you intend to keep the netbook, a memory upgrade is likely worth it. You are correct about the memory limits for most versions of Vista. My amended thoughts on your access problem are that it "has to do with IE settings" and/or your antivirus sees doubleclick.net as malware, which is arguably correct. I'm glad you found a solution that works for you.

 

http://msdn.microsof...s_windows_vista

Edited July 7, 2012 by CyberPro

[Duvel]

If you intend to keep the netbook, a memory upgrade is likely worth it. You are correct about the memory limits for most versions of Vista. My amended thoughts on your access problem are that it "has to do with IE settings" and/or your antivirus sees doubleclick.net as malware, which is arguably correct. I'm glad you found a solution that works for you.

 

http://msdn.microsof...s_windows_vista

Thanks.

Today the problem with Bangkok Post appears to be solved.

As I didn’t change anything to my notebook, I presume that:

1. or Bangkok Post have removed some spyware/malware/adware;

2. or the ESET virus definitions have changed.

I remember that my former virus scanner, bitdefender, also used to point out spyware/malware/adware such as doubleclick.

As to the memory limits I think that some of the limits are just imposed by Microsoft, whereas the 4 GB limit is due to the fact that with a 32-bit word (4 bytes of 8 bits) the virtual addressing space is limited to 4 GB (2³² = 100000000₁₆ = 4,294,967,296) or more precisely 4 GB minus 1 (GB = gigabyte).

I think that with 64-bit software the addressing space limit is 16 EB (2⁶⁴ = 10000000000000000₁₆ = 18,446,744,073,709,551,616) or more precisely 16 EB minus 1 (EB = exabyte), which nowadays means nearly infinite.

Edited July 12, 2012 by Duvel