Do I have spyware/virus?

FlaMtnBkr

FlaMtnBkr

Joined
Oct 20, 2004
Messages
4,704
When viewing this website sometimes it takes forever for the page to load. I will navigate to a different section and it appears everything is loaded but in the bottom right hand side of the browser, the 'page loading status bar' shows the page is still loading and at the bottom left it will say either 'Transferring data from www.google-analytics.com...' most often or 'Transferring data from www.bladeforums.com...' My mouse pointer will also have the hour glass next to it while this is happening.

Other sites seem to load just fine when this happens and I also have restarted my computer just to make sure that didn't affect anything.

Any ideas? I have run ewido and another spyware program and it hasn't found anything.

Thanks!

Ryan

PS it says it is still transfering from google-analytics after typing all this...
 
Seems to me that something is running that shouldn't be. Check your task manager to see if any suspicious entries are running there. Everyone should be familiar with the normal processes that run under Windows.

Try one of the higher-end spyware/malware programs too. A lot of them offer free or trial versions that will let you make a scan. (then you have to buy it to get rid of the suspicious program, but at least you'll know what it is.)
 
Yeah it doesn't seem right to me. I find it weird that it only seems to happen on blade forums though, and not all the time. Some days it seems to do it, some it works fine.

I am running windows XP pro.

Under processes in task manager nothing seems to be using the CPU except for 'system idle process' which bounces around between 95-99. However, under performance, CPU usage is only 0-5%.

There seems to be a lot of processes running at 43. However, I do have a lot of stuff installed and there are multiple printers, sound/video drivers, virus programs running. I know what a lot of them are but there are quite a few I have no idea about.

Well if anyone else has any ideas I would love to hear them. Thanks,

Ryan
 
It's like statistics service, activated by script on the server you're visiting.

You can try to reduce amount of opened connections in settings (too high a number can be producing the slowdown) if you don't want to block it.

You can block " *google-analytics.com* " with e.g. adblock (in firefox) OR add it to your HOSTS file as 127.0.0.1 (=your (local) computer = eliminating any connection to DNS assigned to "google-analytics.com")
 
BTW it is not virus or malware.
You can debate wheter it's spyware (gathering info about you without your knowledge or agreement :)) or not.

You can google :) additional info on google-analytics.com
 
Thanks for the reply Huugh.

I can hit stop and it quits trying to load the page but if I don't do that it tries to load for what seems indefinitely.

I also find it strange that sometimes the same thing happens but its with the bladeforums domain.

I use firefox and I tried finding the adblock you referenced but did not see anything like that. I looked for something to just block a site but didn't find anything like that either. Have any more info for us technically challenged? :)

I tried going to the www.google-analytics.com and of course it said 'not found' so I didn't know what to think.

Thanks!

Ryan
 
With googling that I meant this :)

Adblock (more likely Adblock plus, as Adblock isn't developed anymore) is plugin for Firefox, that allows you to filter unwanted elements of websites.

Or you can edit your HOSTS file - open the file (location of the file) in e.g. Notepad, and add following line (there is an described example in the file) - then google-analytics.com domain (IP assigned to this DNS name) should be blocked
127.0.0.1 google-analytics.com
Click to expand...


(please note, that using way too much (several hundreds of lines) records in your HOSTS can slow down your computer (as Windows will have to check each individual connection and compare it with hosts file))
 
FlaMtnBkr said:
When viewing this website sometimes it takes forever for the page to load. I will navigate to a different section and it appears everything is loaded but in the bottom right hand side of the browser, the 'page loading status bar' shows the page is still loading and at the bottom left it will say either 'Transferring data from www.google-analytics.com...' most often or 'Transferring data from www.bladeforums.com...' My mouse pointer will also have the hour glass next to it while this is happening.

Other sites seem to load just fine when this happens and I also have restarted my computer just to make sure that didn't affect anything.

Any ideas? I have run ewido and another spyware program and it hasn't found anything.

Thanks!

Ryan

PS it says it is still transfering from google-analytics after typing all this...
Click to expand...


http://www.ewido.net/en/onlinescan/
Follow the directions, it is easy.
Delete what it finds.
Save it in your favorites and run it once a week.
The best , $100 free tool there is. :thumbup:
 
huugh said:
With googling that I meant this :)

Adblock (more likely Adblock plus, as Adblock isn't developed anymore) is plugin for Firefox, that allows you to filter unwanted elements of websites.

Or you can edit your HOSTS file - open the file (location of the file) in e.g. Notepad, and add following line (there is an described example in the file) - then google-analytics.com domain (IP assigned to this DNS name) should be blocked



(please note, that using way too much (several hundreds of lines) records in your HOSTS can slow down your computer (as Windows will have to check each individual connection and compare it with hosts file))
Click to expand...

Ok Huugh...I followed your advise and added the entry to my HOSTS file. Now instead of saying 'Transferring data from www.google-analytics.com...' it says 'Connected to www.google-analytics.com...' and behaves in the same way (page not completely loading and hour glass). I used the 127.0.0.1 IP as suggested. Would using 0.0.0.0 work better? I guess it is not a huge deal but it annoys me. Both the fact that the page does not completely load and also the fact that google is tracking you moves...

Thanks for the help so far, at least I feel better about not having a virus.

Ryan
 
FlaMtnBkr said:
Ok Huugh...I followed your advise and added the entry to my HOSTS file. Now instead of saying 'Transferring data from www.google-analytics.com...' it says 'Connected to www.google-analytics.com...' and behaves in the same way (page not completely loading and hour glass). I used the 127.0.0.1 IP as suggested. Would using 0.0.0.0 work better? I guess it is not a huge deal but it annoys me. Both the fact that the page does not completely load and also the fact that google is tracking you moves...

Thanks for the help so far, at least I feel better about not having a virus.

Ryan
Click to expand...

No, use 127.0.0.1 - is not public address, it's reserved IP for local loopback
You can find out more here


What browser do you use? You can shorten the intervals (and tries) before it calls timeout (IIRC Opera has this settings accessible, I'm certain Firefox has it (in about:config)).


(server you are visiting (in case you described, bladeforums.com server) is calling this script: http://www.google-analytics.com/urchin.js , HOSTS file tells him to find it at 127.0.0.1/urchin.js (or localhost/urchin.js) ->
as you don't (presumably::)) run web server on your localhost (even if you did, the file isn't present on given address) it can't access the requested address ->
therefore (dependent on your browser settings) your browser tries to connect to it several times in given interval and if none of these requests is succesful it results in timeout)
 
Hugh is correct - Google analytics is just a 3rd party stats service from Google. The bladeforums site is using this service. if you look at the source code of this page, down at the very bottom you will see this little bit.

Code: 
<!-- Google Analytics -->
<script 

src="http://www.google-analytics.com/urchin.js" 

type="text/javascript">
</script>

<script type="text/javascript">
_uacct = "UA-735919-1";
urchinTracker();
</script>

I've used this service on a couple of sites before. You add that little code block to every page on the site, and what happens is the page fetches a remote javascript file (urchin.js) from google.

What you are seeing happen is that for some reason it's not reaching the google server to fetch the file. I have seen their analytics server create a lag on other sites too. It could even be caused by your own browser settings, the settings on a proxy server (if you are at work or on a network with a proxy) or it could be due to some antivirus or anti-spyware your machine is running.

Google analytics itself is not harmful - web sites use it because it gives them better than average web site traffic stats without costing them server space. It doesn't tell them anything that they wouldn't already be able to tell about you from their other web stats analyzers.
 
Huugh,

Do you know which entry in about:config would allow me to change how long it times out?

After modifying the hosts file it does seem to eventually load (or timeout?).

I probably shouldnt worry with it other than the fact that it annoys me.

Thanks for all the help everyone!

Ryan
 
Why is FlaMtnBkr the only one having this problem? I allow javascript here; I guess many others must too....
 
Cougar - maybe you just don't notice the connection to google-analytics.com?
I'm not sure but I think google use some service like akami (high speed servers place all around the world) as hosts. Therefore your request for the same DNS address may be directed to different server (with different IP) than request of somebody else.

What Flatmtnbkr described is because the google-analytics.com server wasn't responding (or proccessing his request fast enough).
 
Yes, I understand that -- but why doesn't that happen to everybody else who comes to Bladeforums too?

edit: Wait, I'm getting it now. Most of us are not in the same geographical area he's in. Okay, maybe that does make sense....
 
You must log in or register to reply here.
Back
Top