What is lqw.me? And how do I get rid of it?

[WillWinston]

I'm not sure this is the right place to ask, but I find nothing at all about lqw.me by googling.

It shows up in NoScript on EVERY page asking if I want to allow it. I do not and have no idea what it is or where it came from.

I've searched my hard drive and it's not there.

I don't know where else to look.

But since NoScript sees it, maybe someone here will be able to shed some light.

Thanks

[therube]

Seemingly it is malware Generic.tfr!bf!F399CD64FC0C.

Attempt to install a "codec" on your computer, perhaps?

Why is This Site is Just Comeing Up?

See if among other things, you don't have an extension of the sort: \Mozilla Firefox\extensions\{6c4b3bf5-26fe-4373-8571-4e39446b7fd0}.

http://www.threatexpert.com/report.aspx?md5=2e1e85420c6b15b9b078f2903c5e5fa7

(Surprised that is not in blocklist.xml?)

[WillWinston]

Thanks for the feedback. I was unable to find that URI but was somehow able to get rid of the nasty item.

I ran Spybot, CCleaner and ComboFix.

Can't be sure but think it was ComboFix that did the trick.

My experience with ComboFix: It took a long time; didn't provide meaningful status and rebooted w/o my permission. But did seem to do the job where, I think, the others didn't.

Thanks again

[Rich]

I hope the original posters are still around.
I video taped this issue while on my Facebook.
My computer slows so badly that the keystroks wait for about 2 seconds before they register on the screen.

Here is the link of the video. Poor quality but it shows whats happening.
I'm using firefox that allows me to lock out sites from running scripts. It also allows you to see what is happening. This problem is always present with Facebook and one site says its somehow connected to Amazon, Hope someone has an answer.

http://youtu.be/AhE69AYar2Q

[Rich]

Found this site and on the line that references the ASN Amazon is mentioned, not sure why but i did buy something from them about two weeks ago and thats when this constant script stuff started.

https://urlquery.net/report.php?id=195664

[Rich]

http://noscript.net/faq#qa4_1

This link seems to explain alot with Firefox, though I don't fully undestand it.

[Tom T.]

The video link redirects to another URL at YouTube, and at something called youtu.be. Please provide an accurate link to the real YouTube.

The "Warning" messages in the Error Console are often numerous and not so significant. Please open Error Console directly (Ctrl+Shift+J), and click blue "Info" messages. There should be one or more related to NoScript, presumably starting with [XSS]. Please copy and paste all such messages here.

I visited your link to urlquery.net. It didn't say anything about coming from Amazon.
I bought something from Amazon very recently, and didn't notice any unusual script activity, during or after, nor any malware.

Perhaps you visited a third-party link or advertisement, not Amazon's responsibility, that installed malware. Let us please be careful before besmirching a very reputable company.

[therube]

> The video link redirects

youtu.be looks to be a (Youtube) URL "shortener".
Seemingly you take "youtu.be"+"/"+ the youtube "url" ==> http://youtu.be/theyoutubeurl

So:

http://www.youtube.com/watch?v=Ny67ABAGKh4 == http://www.youtu.be/Ny67ABAGKh4

[Rich]

I visited your link to urlquery.net. It didn't say anything about coming from Amazon.

Perhaps you visited a third-party link or advertisement, not Amazon's responsibility, that installed malware. Let us please be careful before besmirching a very reputable company.

Right below the IP is listed the ASN as being somehow connected with Amazon. I didn't try to say that it was from them, I tried to word it so those who referenced and read it would be directed to the possibility of such a connection. I did however change the text.

I don't know why Youtube is using the .be tag, but here is the one on the address bar which contains the BE at the end. http://www.youtube.com/watch?v=AhE69AYa ... e=youtu.be

[dhouwn]

youtu.be is the short link service domain of Youtube (official), one way to get a link for it is to click on share below a video.

[Rich]

youtu.be is the short link service domain of Youtube (official), one way to get a link for it is to click on share below a video.

My first copy and paste was from the share buttons link.
Doing a search concerning youtubes new .be extension, I came up with this, Im not sure why my video has it. I typed in Google "youtubes new BE extention" and this link comes up, notice that Firefox is mentioned in the link, so I'm assuming its because I use Firefox that the BE extension is used?


Is everyone saying they can't play that video? What happens when you do go to the youtube site and try it?

https://www.google.com/search?q=youtube ... =firefox-a

I'm getting to the point where a MAC is looking like a pretty good system. All these problems with Windows based systems is ridiculous, just saying.

[therube]

(It plays fine. Your link is fine. youtu.be was just new to us.)

[Rich]

Thanks LOL, with all the rubbish going on in my computer I'm was wondering what now is going on with Youtube!!

Now I'm trying to figure out how to post the picture of what the one poster requested. I'll get it sooner or later. Thanks for the patience.

Rich

[Tom T.]

What therube said about the video link. Sorry for the confusion.

The IP address reported at urlquery actually traces (via network-tools.com) to amazonaws.com, which is Amazon's "cloud" service for acting as a third-party content delivery network (CDN), similar to Akamai. Anyone can hire them to deliver content, and Amazon can't possibly vet all content so delivered.

No picture was requested, at least not by this writer. Just reproduce the issue, open the Error Console (Ctrl+Shift+J), and do a simple copy/paste of the text messages as requested. (Blue "Info"icon at the top.) No pics needed.