Spyware, Viruses, & Security forum

Question

Anyone know if this is a security threat: Tunisqfwlt.info

by hqcssj / June 22, 2011 2:55 AM PDT

Hi All,

I was browsing Google Images yesterday and when cursoring over a preview image had a file launch to scan a threat under the Windows Security heading. It looked totally bogus and the file name was:

tunisqfwlt.info

I quickly ctrl alt del and closed the browser- Firefox (3.6.17); updated my MSE virus files and shutdown the computer. Cold reboot, quick scan revealed nothing. I reopened Firefox, did a Google search for the file name (domain name?) came up with nothing. Bing search- nothing. Which is odd because I've never been unable to find a file name from a search before.

Went back to my image search again. Same thing happened (checked the spelling too) and I was ready with ctrl alt del to stop it; got it in Chrome too but not IE9. In Chrome it tried to offer to save to my download directory but I was too weirded out to even let that happen. A full MSE scan showed no threat. A search of my computer for the file name- same thing: nada.

Any ideas here? it is too weird but you never know; I am really careful about websites that auto launch executables but since I couldn't find anything on this particular scenario via a couple of search platforms to determine the real (perceived) threat, I thought I would throw it out to ether.

Discussion is locked
You are posting a reply to: Anyone know if this is a security threat: Tunisqfwlt.info
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Anyone know if this is a security threat: Tunisqfwlt.info
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.

All Answers

Collapse -
Answer
You didn't click on anything?
by Carol~ Moderator / June 22, 2011 4:04 AM PDT

That does sound strange.

The fact that you couldn't find any reference to the name (nor I), it doesn't necessarily mean it's not a threat. There are many randomly named files, which ARE a threat. Just to be sure, why not try scanning with Malwarebytes' Anti-Malware and an online scanner?

Malwarebyte's Anti-Malware
http://www.malwarebytes.org/products/malwarebytes_free

ESET's Online Scanner
http://www.eset.com/us/online-scanner

You wrote, "when cursoring over a preview image had a file launch to scan a threat under the Windows Security heading". Can I presume when you wrote, "Windows Security" heading, it wasn't something LIKE this "Windows Security"? While the description of the rogue, does NOT match your experience, there are other rogues which might. Confused Hopefully, you were one step ahead of it, if it was.

I would suggest scanning with the above, if only for peace of mind.

Carol

Collapse -
Nope- Didn't click anything
by hqcssj / June 22, 2011 7:49 AM PDT

No- most definitely did not click anything; just launched and the way it launched is if I did anything but ctrl+alt+del (no cancel button), it was going to start in that very clever mind numbing clicking thing we do absent mindedly.

In response to this question:
<i>You wrote, "when cursoring over a preview image had a file launch to
scan a threat under the Windows Security heading". Can I presume when
you wrote, "Windows Security" heading, it wasn't something LIKE this "Windows Security"? While the description of the rogue, does NOT match your experience, there are other rogues which might. Hopefully, you were one step ahead of it, if it was.

</i>The way it launched, it gave a not quite right but almost believable pop-up window that made it seem like MSE was taking care of the situation but it use the words to the effect that Windows Security had detected a threat- the second indication that it was fishy beyond there not being a mechanism to call off the scan and use my own scanning to determine the threat.

Thanks for the two sites; I will definitely give them at try.

Collapse -
Well
by Bob__B / June 22, 2011 8:35 AM PDT

After you have run the scans to make sure nothing snuck through.

Is there some reason you are running an unpatched version of firefox?

Do you have other products that are also unpatched?

A test.....add the firefox add-on...."noscript".

Visit that image......what happens?

Collapse -
busted- but good add-on
by hqcssj / June 22, 2011 10:21 AM PDT
In reply to: Well

Alright- that total stopped a malicious script.

Until a few weeks ago- I was taking on an online course that relied heavily on a discussion board that couldn't work with the new Firefox so I had to go back to an old version in order to complete the last couple of sessions. I got an A in the class but obviously deserve a lesser grade for not keeping my browsers up to date. I definitely need to do a more thorough checklist of my current packages.

Collapse -
You MAY have dodged a bullet! :)
by Carol~ Moderator / June 22, 2011 8:44 AM PDT

Note I say "MAY". Please DO scan with the two. The (fake) Windows Security alert you described, is not uncommon.

I'm taking for granted you have MSE installed, due to your comment about "making it seem like MSE was taking care of the situation". Why question it? Here's why. Just wanting to make sure we're "on the same page". I'd hate to over-look the obvious.

With hopes for a clean scanning experience....

Carol

Collapse -
MSE Installed
by hqcssj / June 23, 2011 6:16 AM PDT

Yes, I do use MSE primarily but these two additional security scanning sources are now in my tool box. Malwarebyte's Anti-Malware did pick up something that seems to have gotten through (a couple of Trojans) and took care of it because the ESET's Online Scanner didn't find anything. Thanks for the save there.

As usual, the CNET community quickly brought me up to speed where I should be.

I am still curious about that weird script source that ran though.

Popular Forums
icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

Does BMW or Volvo do it best?

Pint-size luxury and funky style

Shopping for a new car this weekend? See how the BMW X2 stacks up against the Volvo XC40 in our side-by-side comparison.