Window 7: Login URL error. Malware ?

[ikonia]

My partners Windows 7 laptop has started displaying this error when she first logs in.

"An error has occured in the script on this page"

line 1

char 7

http://m.xp1.ru4.com/tad?_o=15575&_t=dfa_44463131

Do you wish to continue running scripts on this page.


This to me looks like malware

it starts at login, however a malware search shows nothing and googles not suggesting much beyond the base URL is a common marketing URL.

Any advice on this please ?

[Agent]

It could be Malware:

http://www.malware-control.com/stati...9ff91906b6.php
http://www.threatexpert.com/report.a...80fdbe545e8173

CTRL+F with the domain and you'll find the URLs there. Really needs a manual system check by the looks of it.

[ikonia]

look probable.

I'll have a look for removal information.

thank you.

[ikonia]

two malware scanners failed to pick this up including the microsoft security essentials.

I took a stack dump of the process with task manager (great tool didn't know you could do that)

and it turns out the malware was emedded in what I thought was a legitimate application.

http://www.motioninjoy.com/

I actually put it on the laptop to try the playstation 3 controller with an Amiga emmulator.

When I looked at the trace I could see it trying to hit this URL and a number of others (couldn't figure out for what purpose) I can only assume sort sort of dial home.

Worth being aware of.

[Agent]

I use motionjoy a lot, so thanks for that. I'll see if I can find anything similar on my installations when I get a second.

[ikonia]

did a removal on the software and the problem went away too.

I'm going to have a play with different versions of the software in a safe environment to see what's change between versions.

I would not have been aware of this had the URL they hit for a call back had not died.

I'm assuming later versions update the urls to currently working URLs.

[scaryjim]

Looks to me rather like they may use some form of tracking for targeted marketing purposes - not necessarily malware per se, but also not necessarily something you want on your computer. I've just visited the URL above, and (as I rather suspected), the page is completely blank but does add a couple of cookies to your IE cache. I'd guess these indicate to the appropriate ad server that you use motioninjoy, which will then influence which adverts get displayed. It's the kind of information that's very valuable to advertisers, and it's entirely possible that the whole thing is above board, and that motioninjoy even get a small payout for providing the information / link. It's be nice if they told you about it in advance, though

Also, none of that means those servers couldn't be used for more nefarious purposes, so it's well worth investigating further...

[Agent]

Motonjoy does have adds in the application...might go some way to explain it.

[ikonia]

I'll get a secure environment setup this week and take closer look at this and report back