Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

scorecardreseach popup virus


  • Please log in to reply
9 replies to this topic

#1 Zylorarchy

Zylorarchy

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:01:56 AM

Posted 09 March 2014 - 08:48 AM

Hello! I am new to this forum and hope to both give and receive friendly, helpful advice from you guys :)

 

Yesterday on my Acer Aspire V3-771 (Windows 8) I was on the Wikia website (RuneScape section) which is a completely safe, legitimate website that I, and so many others trust (http://runescape.wikia.com/wiki/RuneScape_Wiki)

 

Whilst I was browsing the wiki a pop-up appeared that looked, like this...

ScorecardResearch-Virus.png

 

I simply crossed off/exited this survey and carried on browsing, and then I thought... well, this has never happened on this website before, and so I checked it to find results which described this as "severe" malware" which is linked to keyloggers, trojans and is linked to b.scorecardreseach.com. Although this popup and b.scorecardresearch.com are essentially the same thing (or so my research tells me), I have not experienced my browsers being hijacked. The home pages pages remain as Google, and this popup survey has not appeared since (not that I have used the laptop much since either).

 

Now, this lapop has been dreadfully unfaithful from day one. Twice it has gone back to acer for repair and even though most problems have been resolved, booting up seemed to have slowed down after the second repair (hard drive was replaced) and the Laptop as a whole seems to be getting slower and slower. Occasionally there are crashes after boot up. Things on the internet too recently seem to have slowed down. Maybe this slowness is related? Oh, and also recently a whole file just seemingly disappeared? I do have it backed up though, as it originally came from the USB stick, maybe I deleted it and forgot about it? I don't know.

 

In terms of steps that I have taken. I have:

  • Run a scan with Malwarebytes, which found nothing
  • Run a scan using AVG, which found nothing
  • Run a scan with avast with found nothing but claimed it could not scan two folders due to "password" protection. I do NOT remember putting those passwords on there
  • Run a scan with SuperAntiSpyware, which found the usual load of cookies (which are not really Malware), BUT DID find four Browser Hijackers, MySearchDial, Imminent, Delta and one other I forgot the name of. Obviously I removed these. I do remember the infections of MySearchDial and Delta. I undid their settings changes thinking I had removed them, but clearly I had not. I do not recall Imminent and so that was a surprise. I have seen a webpage claiming that scorecardreseach can thus be downloaded due to other Browser Hijackers. Yet I had removed their influence over the browsers, so I do not know if this is true, or whether scorecardreseach got on here via some other means. SuperAntiSpyware did NOT find scorecardreseach just like all the others failed to find it.
  • I have talked to two online "experts" both of which have claimed this is a "nasty" virus that is hard to find and eliminate. Of course both wished me to pay them for experts to remotely remove it, I have not pursued this action as of yet.
  • Backing up all of my files that I wished to save (Mostly Word docs, Office setup, pictures, videos, a few anti-virus software), I am now, as I write this, reseting my Laptop to its Factory Settings as instructed to by acer regarding the slow boot ups and crashes. My worry however is that if the virus is in a file present on the USB stick (where I back things up for resets), then I may simply put it back onto the laptop? and I have heard resets/recoveries do not always delete malware anyway. 
  • I also (probably not wisely I know) visited the actual website that does this very survey, one website stated that there you can "opt-out" of this popup and that is what I did... If this is malware though I doubt that would help. However there is one (very well known UK newspaper) site that claims scorecardresearch is actually legit. Here it is (don't worry this is SAFE) http://www.theguardian.com/technology/2012/apr/23/scorecardresearch-tracking-trackers-cookies-web-monitoring 

That's about it really, I would really appreciate your help. My University work is reliant upon my laptop and although I am using my old one to type this... I would much rather have my new one. Thank you for taking your time to read this and to hopefully help out a student in need, I appreciate it. :)



BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:56 PM

Posted 09 March 2014 - 09:19 AM

When searching for suspicious files or malware removal assistance on the Internet, it is not unusual to find numerous hits from untrustworthy and scam sites which mis-classify detections or provide misleading information. This is deliberately done more as a scam to entice folks into buying an advertised fix or removal tool. In some cases if the fix is a free download, users may be enticed to download a malicious file or be redirected to a malicious web site.

What is ScorecardResearch?
About Full Circle Studies

Full Circle Studies operates: ScoreCard Research Beacon


Ghostery is a browser tool for Firefox, Chrome, Safari, Opera, Internet Explorer, which allows you to block beacons, trackers, advertising, analytics and widgets.Resources to help prevent advertisements & block websites:
How To Block advertisements in Firefox, Internet Explorer, Chrome, and Opera
Disable Text Ads in Firefox with GreaseMonkey script manager and the Disable Text Ads script
Disable Text Ads for Greasemonkey
BlockSite

About Adblock Plus
Adblock Plus Overview
- Adblock Plus for Internet Explorer
- Adblock Plus for Firefox
- Adblock Plus for Chrome
- Adblock Plus for Opera
- Adblock Plus FAQs
Element Hiding Helper for Adblock Plus - How to Use the Element Hiding Helper with Adblock Plus
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:56 PM

Posted 09 March 2014 - 09:21 AM

If you want to check your system further...continue as follows:

Please download and use the following tools (in the order listed) which will search for and remove many potentially unwanted programs (PUPs), adware, toolbars, browser hijackers, extensions, add-ons and other junkware as well as related registry entries (values, keys) and remnants.

RKill created by Grinler (aka Lawrence Abrams), the site owner of BleepingComputer.
AdwCleaner created by Xplode.
Junkware Removal Tool created by thisisu.

1. Double-click on RKill to launch the tool. A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully. A log file will be created and saved to the root directory, C:\RKill.log. Copy and paste the contents of RKill.log in your next reply.

Important: Do not reboot your computer until you complete the next step.

2. Double-click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • After reviewing the log, click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
-- Note: The contents of the AdwCleaner log file may be confusing. Unless you see a program name that you recognize and know should not be removed, don't worry about it. If you see an entry you want to keep, return to AdwCleaner before cleaning...all detected items will be listed (and checked) in each tab. Click on each one and uncheck any items you want to keep (except you cannot uncheck Chrome and Firefox preferences lines).


Close all open programs and shut down any protection/security software to avoid potential conflicts.

3. Double-click on JRT.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log file named JRT.txt will automatically open and be saved to your Desktop.
  • Copy and paste the contents of JRT.txt in your next reply.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 dls62

dls62

  • Members
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Berkshire, UK
  • Local time:02:56 AM

Posted 09 March 2014 - 09:23 AM

I've just checked that site on virustotal and it comes back with a 0/52 score so it's almost certainly safe.  There is scorecardresearch script on the site so that is probably why you got the pop-up.

 

If you use the Firefox browser, you can install NoScript which will block scripts like this unless you specifically allow them to run.



#5 Zylorarchy

Zylorarchy
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:01:56 AM

Posted 09 March 2014 - 09:35 AM

I've just checked that site on virustotal and it comes back with a 0/52 score so it's almost certainly safe.  There is scorecardresearch script on the site so that is probably why you got the pop-up.

 

If you use the Firefox browser, you can install NoScript which will block scripts like this unless you specifically allow them to run.

 

When you say that you have just checked "that site" are you referring to http://runescape.wikia.com/wiki/RuneScape_Wiki? Or Wikia generally? Or the Scorecardresearch website itself? how exactly do you check the "script" of the site? Sorry for the noob questions. :P



#6 Zylorarchy

Zylorarchy
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:01:56 AM

Posted 09 March 2014 - 09:39 AM

When searching for suspicious files or malware removal assistance on the Internet, it is not unusual to find numerous hits from untrustworthy and scam sites which mis-classify detections or provide misleading information. This is deliberately done more as a scam to entice folks into buying an advertised fix or removal tool. In some cases if the fix is a free download, users may be enticed to download a malicious file or be redirected to a malicious web site.

What is ScorecardResearch?
About Full Circle Studies

Full Circle Studies operates: ScoreCard Research Beacon


Are you saying then that the pop-up is nothing to worry about? While I understand there are scam sites, many sites I have looked at provide free information in ways to eliminate Scorecardresearch and b.scorecardresearch.com.

 

For example:

http://botcrawl.com/how-to-remove-the-scorecardresearch-virus-pop-up-survey-and-b-scorecardresearch-com-malware-trojan/

https://epiac1216.wordpress.com/2010/12/03/how-to-crush-the-b-scorecard-research-com-bug/

http://forums.anvisoft.com/viewtopic-53-2346-0.html

 

I do not want to sound like I am undermining you. But only the Guardian website actually says this is a legit popup, not to mention everyone has complained about b.scorecardresearch.com being a browser hijacker. 



#7 dls62

dls62

  • Members
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Berkshire, UK
  • Local time:02:56 AM

Posted 09 March 2014 - 09:54 AM

 

I've just checked that site on virustotal and it comes back with a 0/52 score so it's almost certainly safe.  There is scorecardresearch script on the site so that is probably why you got the pop-up.

 

If you use the Firefox browser, you can install NoScript which will block scripts like this unless you specifically allow them to run.

 

When you say that you have just checked "that site" are you referring to http://runescape.wikia.com/wiki/RuneScape_Wiki? Or Wikia generally? Or the Scorecardresearch website itself? how exactly do you check the "script" of the site? Sorry for the noob questions. :P

 

 

The URL I checked is http://runescape.wikia.com/wiki/RuneScape_Wiki, and by looking at the page source code it's possible to identify a lot of information about what runs on the page.



#8 Zylorarchy

Zylorarchy
  • Topic Starter

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:01:56 AM

Posted 09 March 2014 - 10:26 AM

 

 

I've just checked that site on virustotal and it comes back with a 0/52 score so it's almost certainly safe.  There is scorecardresearch script on the site so that is probably why you got the pop-up.

 

If you use the Firefox browser, you can install NoScript which will block scripts like this unless you specifically allow them to run.

 

When you say that you have just checked "that site" are you referring to http://runescape.wikia.com/wiki/RuneScape_Wiki? Or Wikia generally? Or the Scorecardresearch website itself? how exactly do you check the "script" of the site? Sorry for the noob questions. :P

 

 

The URL I checked is http://runescape.wikia.com/wiki/RuneScape_Wiki, and by looking at the page source code it's possible to identify a lot of information about what runs on the page.

 

 

Thank you! It seems I might have got worried about something that is legitimate... I also went to the source code and found it there.



#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:56 PM

Posted 09 March 2014 - 11:43 AM

Are you saying then that the pop-up is nothing to worry about? While I understand there are scam sites, many sites I have looked at provide free information in ways to eliminate Scorecardresearch and b.scorecardresearch.com.

None of the examples you provide I would recommend or consider trustworthy. Scorecard Research is not malware nor is it connected to a Trojan infection. That is all misinformation and used to get folks to seek their Tech Support for help or download their removal tools. If posted solutions do not work, they ask you to call them but many times fail to say that such assistance is provided at a cost.

In many cases these issues are the result of unwanted toolbars, add-ons/plug-ins, and browser extensions which come bundled with other free software you download. They can often be the source of various issues and problems and are more accurately classified as Potentially Unwanted Programs (PUPs) which do not fall in the same category as malicious files such as viruses, Trojans, worms, rootkits and bots. A PUP is a very broad threat category which can encompass any number of different programs to include those which are benign as well as problematic.

If folks are going to post removal guides...they should at least know the difference between an unwanted toolbar and a virus or be honest about their explanation. Just another reason there is so much misinformation on the Internet.

Scorecard Research does not appear to be a PUP but it doesn't hurt to run the tools I suggested to ensure the system does not have a lot of crapware which too can be responsible for unwanted popups.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 michaelmeis

michaelmeis

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:07:56 PM

Posted 02 February 2016 - 12:02 AM

Don't know if anyone is still interested but based on the traffic generated by ScoreCardResearch.com it appears to be a Taplika class PUP






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users