Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've had this launcher for over a year, no problems. It's the regular Minecraft.exe launcher you can find on minecraft.net. All of a sudden, when I opened it, Avast said it blocked a malware site. The URL it blocked was:

http://pixel.quantserve.com/pixel/p-19UtqE8ngoZbM.gif

I do not recommend clicking it if it was changed into a link. I searched "pixel.quantserve.com/pixel/p-19UtqE8ngoZbM.gif" using Google and found it occurred in the HTML code of many sites that said they were being attacked, or sites that are about hacking.

Why has Avast suddenly blocked this? Did my launcher change, or was it a virus just discovered? Is it an actual virus?

EDIT: ANSWER FOUND:

I found out why. Apparently, it is a problem. Tumblr has been hacked. The image is set to appear at the end of every page. When you go to tumblr.com, it gives you a internal server error. EDIT: It does not say internal server error anymore, but the image is still at the bottom of every page. At least, every page the Minecraft launcher loads. The Minecraft launcher displayes something from tumblr, and tumblr has a img tag requesting the malware url, which, is actually malware. See http://forum.avast.com/index.php?topic=114593.0 for more information.

share|improve this question
    
FWIW apparently some other people are having trouble - minecraftforum.net/topic/1679645-malware and minecraftforum.net/topic/1679627-minecraft-infected-s. Presumably there's something on the landing page for the launcher it doesn't like. –  Shinrai Feb 7 '13 at 21:55
2  
Please post your answer below as a real answer; you can do so after around 7 hours. –  slhck Feb 7 '13 at 22:19

2 Answers 2

up vote 0 down vote accepted

Calm down, tumblr.com possibly had some configuration error that caused a regular website to be loaded instead of a picture. First, have you looked up what quantserve exactly is? It is just a web analytics tool, not malware (statistics page here). Even Stackoverflow uses it.

As for the Google results, it seems that Tumblr generates HTML that can be put on a website. Users then copy it without making modifications, resulting in a tracker being inserted. Example on SO.

Calm down. Really, this is just noise, there is nothing wrong with this. Avast just scared you. If you do not like it, use a Linux distribution (say, Ubuntu) with Firefox+NoScript.

share|improve this answer

The launcher displays a web page when run. That page has likely been compromised and is serving the link you mentioned.

share|improve this answer
    
No, when I go to the web page, it does not give me the malware warning. –  user1474837 Feb 7 '13 at 22:02
    
@user1474837 Turn of javascript. The malicious img is located within an noscript element –  GameScripting Feb 10 '13 at 11:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.