Using Noscript while opening links

Question

I opened two emails. Supposedly one was from Zendesk (the other I did not realize was from another source. Attention was elsewhere). Anyhow, I clicked on the unsubscribe button. Normally, this a good policy for legitimate sources. Men don't always multitask very well :/

In this case, I clicked on the one from the supposedly non-legitimate source. I was wondering, since I have noscript on at all times, could I possibly get infected? All I got was a spinning circle (in the tab) with the new tab internal address.

Note: I obviously have the scripts enabled for my email provider. But not for random websites.

According to the Zendesk email, they claim that the person/group had some malware. Something about a file or something. Now, I have zero clue whether that email itself is legitimate at this point. Have I dealt with Zendesk in the past? Yes. With which email account? I cannot remember.

In any event, the email does not come with an attachment as Zendesk claimed it would. Anyhow, this is what they wrote:

Your computer(s) may be infected with a virus if you recently:

Opened a file from "Joyce Lim" named "info.xls", "information.xls", "infos.xls", "mail.xls", "market.xls", or "marketing.xls" related to a job opening entitled "Need mail and other lead generation consultation." Enabled macros from the file, or already had your macros enabled

I am currently running MBAM, and will run superantispyware afterwards, and then Avast. Finally, I will run norton power eraser.

Answer 1

You're most likely fine although depending on the attack (how targeted, how much the attacker knows about their audience). If you didn't open any attachments you most likely do not have malware on your computer because a javascript to sandbox escape zero day is very very valuable and would likely be weaponized by or at the government. As long as you don't have any vulnerable extensions (any extensions which interface directly with an unsandboxed application are dangerous and can potentially be exploited for RCE) you are likely safe on this front.

The worst case scenario is that the unsubscribe page had some malicious content in it that attacked your other accounts using iframes or some other CSRF approach. With javascript disabled except for special domains your are still quite vulnerable to some attacks however these only would affect vulnerable websites and the accounts you use on them. So worse case scenario your account on a website has some XSS injected into it. Without javascript exploiting an XSS is more difficult however if it's stored you may eventually end up signing in without noscript and then it's game over because pretty much any action you can take on the site the attack can now as well.

The issue with these web to web attacks is that once you're infected it's really hard to know and it's up to the site operators to detect and fix these vulnerabilities. Keep noscript running but I wouldn't be too worried since it's out of your hands at this point.

Answer 2

Antispyware/Antivirus tools might not help and their efficiency can not be trusted.

The best method would be to delete your local OS account and its contents, and create a new one. and perform a backup. Of course this assumes you didn't use administrative account while opening attachment.

Afterwards, changing passwords that were stored on local account.

However if you did use administrative account then the only way to return trust to OS is to clean reload.