IMPORTANT: Guys there's a bad virus going around.

[Zaria DeGantz]

Okay guys, I need to put this out there! There's a nasty virus going around, and chances are ou won't even notice it!

I found this on tumblr, as well as some of the art sites I frequent, so I'm going to copy and paste the whole thing right here:

Oh, here is the tumblr post I reblogged from the other people: (WITH VISUAL IMAGERY) if you are interested:
morghiemonz.tumblr.com/post/42305336289/onlytotaldrama-twofingerswhiskey-roxycal

~~~

!!!URGENT: BAD VIRUS GOING AROUND, PLEASE READ!!!

This is ScorecardResearch. A terrible virus, an awful popup, & something that should be avoided at all costs.

Be careful of the malicious websites you go on. One of them may install behind your back this popup. ScorecardResearch is a dangerous pop-up virus. It seems legit, right? But why would something just pop up without your permission? I received this twice. After the second time, I decided to look into it.

I started noticing that whenever I loaded a page, Chrome would have this at the bottom:

Why is this working behind the scenes of my browser?

According to BotCrawl.com, this is what ScorecardResearch is:

“ScorecardResearch.com, including b.scorecardresearch.com, and Scorecard Research surveys are categorized as severe malware, and is most noted to be connected to a Trojan infection that attempts to disguise as a legitimate marketing research group collecting anonymous data and information about the user’s internet activity, usage, etc.”

Do not click into this. Don’t touch anything. Close the tab immediately. Go through all your programs, addons, etc, & delete anything suspicious. Scan your computer, delete your cookies & clear your cache, do whatever it takes. You can read more here.

tl;dr — Do not trust ScorecardResearch. This thing will fuck you over.

Other person

*****GUYS. LISTEN. I HAVE THIS. I AM AN EXPERIENCED DEFENSIVE HACKER (I HACK THE HACKERS), AS WELL AS A LICENCED COMPUTER TECHNICIAN. AND I STILL GOT THIS PIECE OF SHIT MALWARE. NOBODY. IS. IMMUNE.*****

I’m not an idiot about what pages I visit. Chrome, Avira, and my own protections that I made with my own ten fingers made sure that I was able to browse safely. I have NO clue as to where this little bugger came from, but I was alerted when random words in a post were underlined!

Shortly after that, a keylogger was detected. I accessed it and terminated it from the source, but it cropped back up for another six hours until I was finally able to get it off my trail. Because of how long this had gone undetected (around two days) I had already lost access to my banking information, my email, two of my five YouTube accounts (I do tutorials and machinima), and an account for a small forum that I no longer visit.

I was screwed.

I had to get a new bank card, and I got the rest of the accounts back eventually, except for the one I no longer used or cared about. I had to switch to Opera from my beloved Chrome as I formulated a plan. Avira picked up nothing. I don’t trust any other antivirus to do a clean enough job about it, but it still didn’t find anything. There was nothing installed in my Extensions or in Control Panel.

I installed ScriptSafe and blacklisted b.scorecardresearch. I think that you all should do the same. This also affected my girlfriend’s mother who is a Mac user, so it’s not only a Windows thing.

Yet another Person:

oh my god i clicked on no script to go add it and when you see the scripts that are running ONE OF THEM WAS THAT idkijgkdjg

i don’t think i’ve ever mashed ‘untrusted’ harder in my whole life

~~~~
Me: (Morghie)

So I use firefox, and Scriptsafe does not work on it, HOWEVER; there is something VERY similar: NoScript.

it's annoying to use AT FIRST, but I downloaded it because I'd rather be safe than sorry! I also checked the things it's been blocking, and i FOUND that scorecardresearch thing amoungst the blocked list 8I

I get really paranoid about this kind of thing, so I've changed my passwords, and have done virus scans, etc. I feel like I need to put this out there though!

Spread the word! Protect your PCs!

[Kiba Takenaka]

Hello Morghie!

Since I am in the technical field, I know about a lot of fake virus scams, as well as legit viruses which ARE warned of online. So when I saw this, my first reaction was to research the problem further. This is what I found:

While ScorecardResearch IS a PUP (Potentially Unwanted Program) used to track your data online, it is NOT a virus. The actual definition of a virus is an unwanted program which will replicate itself without user interaction.

What it does is sends data about you to anybody who pays it to do so; while the script is running, it sends your stuff to any of its numerous sponsors, which is not something you want happening... but not, actually, a 'virus' in the sense of the word.

It WILL, however, send your data to all kinds of nasty sites that WILL give you legit viruses. It is an untrustworthy piece of semi-malware,a nd you SHOULD protect your computer against malware ANYWAY, not just ScorecardResearch.

These types of almost-spyware have a nasty habit of opening holes on your PC to send their data through, which opens you up to the keyloggers, viruses, etc. that the other people you read from mention getting.

My personal recommendation is to keep an up-to-date antivirus and anti-spyware program on your computer. Things like NoScript are useful, but not necessary, for keeping the pop-up scripts from running, while a good anti-virus (I recommend Avast!, with Avira as a close second - both are free) will keep your computer from getting the 'virus' end of the problem.

For anti-spyware, I personally use SuperAntiSpyware and run a full scan of each (or try to) once a month or when my computer gets too slow. SuperAntiSpy does, I believe, catch ScorecardResearch.

ScorecardResearch will NOT steal your passwords. It is NOT an actual virus. However, it does serve as an intermediary between your computer and shatdy websites which DO have viruses. Keeping the minimum precautions I've mentioned above and practicing safe browsing habits (not clicking on popups, only going to trusted sites, not watching internet porn, etc.) should keep you safe and virus-free.

Any extra precautions you wish to take are, of course, up to you.

Hope this helps!

-Miri

PS: One recommendation that I don't find necessary, but many people do follow, is running a third-party firewall. For that, I recommend Comodo. There's another popular free one out there called "Zonealarm", but I recommend against it because it makes using the internet incredibly slow and is almost impossible to get rid of completely. The same goes for free antivirus "AVG" which also has a lot of overhead, spies on you, prevents you from doing things it classes as risky without your permission, and is imposible to get rid of completely.

[Kiba Takenaka]

Oh! And here's the Yahoo! Answers thread:

malaysia.answers.yahoo.com/question/index?qid=20121223092344AAvNgQo

And another site with articles about ScorecardResearch:

www.bloggernews.net/122771

[shanira]

.__.

Whether or not we have the technical term right, I think we can all agree it's something we just don't want to begin with.
That and I'm sure in one of those tumblr threads one of the victims mentioned having Avira and it did nothing...?

[Kiba Takenaka]

And.... as a technical professional, yes, there are some things AV programs don't catch. And I mentioned, NoScript will help stop the process.

Avira didn't get rid of the problem because it's not a virus; SAS will probably get rid of the problem itself and AV programs, 90% of the time will get rid of the ensuing viruses that stem from the problem.

That other 10%, you should seek professional help to get the rest of the problems taken away - the keyloggers, etc.

I'm NOT saying NoScript doesn't work. I'm saying, it helps, but panicking doesn't. And whatever extra precautions you want to take are probably not going to /hurt/ anything. I didn't tell you NOT to take them.

[Zaria DeGantz]

Viruses, malware, etc...It's all the same to me D:

I was just sharing what I knew, because as I said before: The info has been circulating the sites I frequent, and I don't think anyone wants this on their PC. Virus or not.

As for the passwords- As I said, I get really paranoid whenever I hear something like this, so this was just a personal choice on my behalf. They needed updating anyway.

I do Virus/Spyware scans on a regular basis, and I have a fantastic antivirus/internet security program that has yet to fail me.

It's just something I thought needed to be shared is all.

[shanira]

the average joe will look at this and view it as a virus no matter what information you give them :/ its like how I'm a skincare specialist and people point at their face and ask "why do I have wrinkles?" and I tell them it's not a wrinkle, it's superficial dehydration. they've no clue what the hell I'm talking about even after I get into the science of it.

I seriously doubt it matters whether or not we understand in full what a virus is, what parts of this PUP functions what and causes x string of chaos on a computer, but that we understand the basics of how to protect the computer, ie: antivirus, clean this, enable this, done! xD everyone be safe! no panicking was ever done.

[Kiba Takenaka]

Alright. I misunderstood what you were tryng to say, then, Jess. ^^;;; I do occasionally get caught up in details and I'm very proud of my work~ Anyway, those are my suggestions and they're good things to do anyway. The NoScript thing is pretty solid, too; so yeah. I just wanted to put in my two cents... didn't mean to offend anyone ^^;;;;;;

[shanira]

Nah it's all good, I get it XD;