Friday, September 18, 2009

2591 Strange message

Friday, September 18, 2009

Charles Manning, letter in the Mensa Bulletin:
“Religious freedom means not only freedom to practice your religion,
but also freedom from being forced to practice someone else's.”


---------------------------

I went to a news site, and this message popped up in a little window of its own:
"Window videoAdPlayer is already registered in the DOM! Make sure you use setDestroyOnClose() or destroyOnClose: true in the constructor "
Now just what the hell does that mean? I hope it wasn't really meant for me, because if so, I don't have the faintest idea what it wants me to do. And I sure hope somebody, somewhere, closed something....

Later edit, 9/20/09: A lot of people must be seeing this message, because a lot of people are ending up here through Google searches, so I'll pass on some additional information. I can't say for sure that the above message had anything to do with it, but within minutes of seeing it, my scanners and sniffers freaked out, reporting the presence of a trojan involving "VUNDO.gen.bp" (see http://en.wikipedia.org/wiki/Vundo, very scary), "lovojefu", and "mozulavo". Because my faithful protectors prevented updates to the registry, the trojan was fairly easy to remove/disable.

If you saw the above message, you might want to scan your system, or restore from backup.

6/8/10 Edit: As you can see from the comments, people are getting this message now when they visit Salon.com. This time it appears to be innocent. The appearance of the message may or may not signal an attack; it may be just a bug in the code (probably Java). But keep in mind that any time an error message appears it's an indicator of sloppy code and inadequate testing, which is more likely to turn up in a trojan or virus. Don't be lulled into complacency. Scan just to be safe.
.

9 comments:

Anonymous said...

This reference to Vundo sent me on a long quest to find the virus. I never did, but I later discovered that at least one other person got this same message when they visited the Salon.com website:

"Window videoAdPlayer is already registered in the DOM! Make sure you use setDestroyOnClose() or destroyOnClose: true in the constructor "

Since I had just followed a link to Salon.com when this message appeared on my computer and I have none of the symptoms of Vundo infection and can't find any trace of any version of the Vundo virus on my computer, I now believe this message has something to do with the Salon.com website and possibly others and is not caused by a virus on my computer at all.

~~Silk said...

I've never visited salon.com, I don't think, although it's interesting that you and I had both visited news sites. I believe the message is simply a Java error message. Somebody coded something badly, or tried to do something already done (i.e., didn't check before performing some operation). You're more likely to see errors in unofficial or unverified code. Trojans and viruses, for example.

I've been getting 30-50 world-wide search hits per day on this post for the past week (today is 5/29/10), so lots of people are seeing the message. Something's going on.

It's interesting that with all the visits, only one person has left a comment. I guess no one other than you, Anonymous, is interested in helping anyone else by providing more information. Bits of info add up to conclusions, so thank you for your contribution.

Mystified said...

Got it hitting Salon, then again 3 hrs later trying to watch trailers on vuguru.com, none of which would play. Then, after viewing two shows on the CW, and a few other sites, I go to PhoebeTv.com where all of the shows play... without sound! I can go right back to other vids (YouTube, Hulu, whatever) and the sound plays.
So, I have no clue what this message means, but I have no signs of virus according to malwarebytes and AVG.
Running Firefox (latest) and just updated Java yesterday.

???

Anonymous said...

Same experience as above: salon, message, tried to watch video and had no sound. . . but I'm on a mac so I never thought about the idea of malicious software. Besides, when the no sound thing happened again when I went to use VLC, and mute wasn't on, on computer or program, I shut it down, restarted, and then audio came back.

But I do wish I knew what the error message indicates. And if I should be concerned.

Alex said...

Same thing. I went to Salon, got the message (for what it's worth, I was running Chrome on OSX at the time).

I've got no other details, but I do think the way that a random blog post can become a nexus for questions is really interesting.

Anonymous said...

Yup, that pops up for me when I visit Salon.com, too. Malware scans negative, but I'll keep trying. If it's not malware, then it's just a programming annoyance.

sue56 said...

has anyone gotten an answer for this? I got the same message when i was attempting to send a feedback form on Activia.com my form cleared but I don't know if they actually got it or not.

Anonymous said...

This message originates from an open source Javascript component that is used for floating dialog like windows on wep page. It is an error message and completely harmless. I have tried this component in my web development and are currently trying to get some more info from the original author.

Anonymous said...

I get the same message when trying to access my bank. My local computer guru doesn't understand it either.