I'm getting virus alerts on PH - anyone else getting them?

[tribbles]

My Panda Antivirus has just started to kick up a fuss about a virus on PH.

http://cdn.code.haymarket.com/injector/deliver/pis...

It's reporting the virus as "JS/Agent.MZT".

Only just started, and is happening on every page.

[Rach*]

Me too!

My work PC threw a mental yesterday and its just picked up the same virus as you.

[tribbles]

Are you using Panda as well? I did a bit of digging, and it appears to be a virus that only Panda spots, and it was found two days ago.

I think it's a false positive (I had a look at the JS code that is downloaded).

As a temporary measure, I've modified my Windows' hosts file so that the domain is effectively blocked.

To do this, you need to edit C:\Windows\System32\drivers\etc\hosts in notepad, and change the line that starts:

127.0.0.1 localhost

To:

127.0.0.1 localhost cdn.code.haymarket.com

Save that, and restart the browser. Note that this works in XP; not sure about Vista and above.

The only slight downside that I've seen is that you don't get adverts.

[RacingPete]

I am not getting any problems on my pc reporting this but I have highlighted it to the team that run this bit of code to see if they can spread any more light.

[stumpage]

I'm getting them also. I run Panda AV as well.

[Rach*]

Yep I'm using Panda too, I'll try doing that code thingy, thank you

[Mr Will]

Those of you that are having problems, can you post which browser and operating system you are using?

[tribbles]

Firefox, Windows XP.

[Rach*]

Windows & Explorer

[stumpage]

Internet Explorer 8 with Windows XP

Edited by stumpage on Thursday 19th November 13:25

[tribbles]

I'm pretty sure it's Panda that's the problem, rather than the browser...

[Rach*]

Its doing bad things to my pc, posting from my mobile

[Rach*]

tribbles said:

Are you using Panda as well? I did a bit of digging, and it appears to be a virus that only Panda spots, and it was found two days ago.

I think it's a false positive (I had a look at the JS code that is downloaded).

As a temporary measure, I've modified my Windows' hosts file so that the domain is effectively blocked.

To do this, you need to edit C:\Windows\System32\drivers\etc\hosts in notepad, and change the line that starts:

127.0.0.1 localhost

To:

127.0.0.1 localhost cdn.code.haymarket.com

Save that, and restart the browser. Note that this works in XP; not sure about Vista and above.

The only slight downside that I've seen is that you don't get adverts.

I've just done that and I'm not getting a mental panda now, thanks very much!

from a total technophobe, that was very easy to follow

[RacingPete]

The link in the first post is the javascript code we use to run all the display adverts, site statistics and other little things so is something we have developed in-house and the javascript is well known to us. So I would be surprised if it has an infection and thus think it is a false positive too. Particularly as one virus scanner has picked it up.

[tribbles]

RacingPete said:

The link in the first post is the javascript code we use to run all the display adverts, site statistics and other little things so is something we have developed in-house and the javascript is well known to us. So I would be surprised if it has an infection and thus think it is a false positive too. Particularly as one virus scanner has picked it up.

I read the Javascript and I couldn't see anything that leapt out at me as being a virus. I also worked out that the adverts would be affected from that too

The odd thing was that I didn't appear to get any adverts on my Mac last night at home (which worried me a bit). I'll have another go with that.