http://d1ros97qkrwjf5.cloudfront.net/42/eum/rum.js

Alright , I have tested with IE and Chrome one more time, still getting same warning with both browsers, kinda odd.

Hi Gangplank,

What for users that have ABP in Fx or Chrome with fanboy’s list installed. Are they not being affected?

polonus

Ok I’ve kinda found a “solution” for now, Went ahead and installed the DoNotTrackMe addon and the popup stopped.

Addon Website: http://www.abine.com/dntdetail.php

Unfortunately there’s no opera version but at least it’s avoidable.

I’ve tried disabling the addon and visited ausgamers.com and the avast popup appeared, enabled the addon and no popup. I’ve tested this only on firefox.

If this helps let me know please, at least I’ll know if the addon is making effect or not.

Cheers!

Hi polonus,
I’ve just installed adblock plus for opera and updated the block list from fanboyz, not getting the same warning anymore for now, will do a test with chrome right now with the same setup and i will give you an update on the result asap.

cheers.

Okay, I’ve just done testing with chrome, with adblock and updated block list, Twitch TV is fine for now, but when visiting Gawker.com and AusGamers.com I was still getting the “RUM” warnings, I think adblock does not affect it, at least on my end.

Cheers.

I’m having the same issue when visiting http://www.captureminnesota.com/ with both Firefox & Chrome beginning today. Is this a false positive & how can I stop it from popping up all the time?

Thanks.

Kim

@Gangplank,

Good suggestion for those that want to be without that kind of ad-monitoring to have it blocked for now and also as it later seems to come unblocked by av-solutions…
Fanboy’s adblocking list does not flag it for no reason, I guess…

@micahwedemeyer

Wepawet gives the code as benign. And according to me it does not fall into the realm of suspicious or unwanted malicious code. The injecting nature of the benign code could have been an issue here to flag it. So wait for what the avast team analysts will decide.
On second thought I know that there are users that would like to block that code via an anti-tracking add-on, or via enhanced adblocking or via NoScript or RequestPolicy add-ons in firefox or sinilar extensions for GoogleChrome. Adblocking and the evasion thereof by ad-launchers is an ongoing chess-game…

polonus

UPDATE
Installed DoNotTrackMe on Chrome as Jonny788 suggested, the warning somehow stopped for particular reason. Tested multiple times and it seems to be the perfect solution for now.

For anyone having the pop up issue, here is the link to the addon.

hxxp://www.abine.com/dntdetail.php replace(x) with (t).

I get the alert with IE, and I have removed all code that I can find with the Cloud attached to it. Still getting the alert.

This is on the differing variant:

In the code that comes up with Internet Explorer, block “beacon-.newrelic.com” without the “” and see if that is sufficient to block the alerts?
On what the code does: https://newrelic.com/docs/features/how-does-real-user-monitoring-work → link info from: Jonah Kowall and Will Cappelli

polonus

GET Request with Firefox 17.0.1 returns a benign 0/46 here: https://www.virustotal.com/file/147683625bd70ea7029186e4b71a622c8e4f851fd2a3941dd115a2bdddd91259/analysis/1357254590/

It is only natural that “DoNotTrackMe” will prevent the alert, as “Real User Monitoring” is a form of tracking.

~!Donovan


http://i.imgur.com/1RXSE.png

More Details

I should have mentioned, the following additional details:-

I am using:

Google Chrome 23.0.1271.97 (Official Build 171054) m
OS Windows
WebKit 537.11 (@136278)
JavaScript V8 3.13.7.5

Avast 7.0.1474
virus definitions 130103-1

As micahwedemeyer has pointed out, its part of the newrelic api for performance monitoring a website. Hence why its popping up on numerous unrelated websites I guess.

I could access the JS code directly via https variant of the URI and avast does not alert, but accessing the http variant it does, which is a bit odd. Also it doesn’t matter which version? (the /42/ part of the URI) I access, I can change it to a different number, and for the http version avast will alert, for the https version it wont. The code is identical in both cases.

I updated my AdBlock list on both Chrome & Firefox and it stopped happening if I use Chrome but it still pops up with the warning if I use Firefox on http://www.captureminnesota.com/.

Kim

Getting the same error on my PC using Firefox or IE.

Infection Details
URL: hXXtp://d1ros97qkrwjf5.cloudfront.net/42/…
Process: C:\Program Files\Mozilla Firefox\firefox…
Infection: URL:Mal

This script is also present on various wikis on http://www.wikia.com/Wikia

Guys whenever I go to kongerate a well respected website for games, I get the warning EVERY TIME no jokes, you can test it too, just go to it and you will get it for some reason, never had this happen before

Frustrating that no one from Avast is addressing this formally… I don’t want to make it stop for MY computer, I want it to stop for any of my visitors that come and get this seemingly bogus warning!!

Still getting the same pop up this morning :frowning:

Wish someone from Avast would sort this out >:(

I too have gotten this infection pop up when i visited a trusted site. Avast get on the roll and DO SOMETHING!!! Tell us wth this script is, whether it is a virus or a false pos… But fix it, come on this is nuts. >:(

Well, I’m going to uninstall Avast on my laptop and try another anti-virus program for now.

Maybe someone at Avast will take notice of this and extend the courtesy of an update. >:(