self-added javascript

[paul_it]

I installed some programs in my computer (realplayer included) and the next time I rebooted my machine, I got some sort of system message, which was in fact an IE pop-up, with the following message:

Tribalfusion "your computer may be infected with harmful spyware" or something like that.

Then, I checked the source of some websites and I found the following tag just before </head>

<script language='javascript' src='http://127.0.0.1:1025/js.cgi?pca&r=27506'></script>

It's curious, 'cos I have no daemon listening to port 1025...

I deleted all my cookies, and no spyware detector found that tribalfusion malwhere...

Any idea? Is there any connection in between both things?

Cheers,

Paul

[tashi]

Hi there.
Real Player does call home which is why it is often not recommended.

However someone should take a look at the system to see if there is a reason you received a popup about Tribalfusion.

Please go here and follow instructions.
Before you post a log (http://forums.spybot.info/showthread.php?t=288[/url)

Start a topic here:
Malware Forum (http://forums.spybot.info/forumdisplay.php?f=22[/url)

Someone will then take a look and advise you.

Cheers.