Clicked on fake "Download Now!" ad on file transfer site (legal file for legit purposes) by accident; does anyone know what measures I should take?

Question

I was sent a file by a coworker via "sendshare" - my first time using the service. The page loaded a bit slowly and the ads came in before the actual download link. I was in a hurry to get the file - it was a time-sensitive job - and I ended up clicking on the deceptively-designed ad at the top of the page instead of the download button. It took me to a page that looked just like the download page but with no logo and the same fake "download now!" link at the top. My hackles went up and I closed the tab before clicking again.

I went back to the page, realized my mistake, got the real file and completed the work. Afterwards, I opened up the same page in my Linux machine, went to the scammy page, and saved the source in order to examine it. It was a WALL of javascript that I can't make heads nor tails of.

I'd like to include it here so people can look at it and maybe tell me what I need to look for on my system (I'm running Security Essentials as we speak; AVG just finished; MalwareBytes is next on deck) or online to reduce my exposure, but it's so big I don't want to overwhelm people or Stackoverflow's system. I was logged into Gmail at the time, not Facebook, so I don't know if I need to change any passwords (I already use two-step verification on Gmail) or not.

Answer 1

what you risk the most is a stored malicious code. Therefore, cleaning countermeasures as you are doing is quite good in case the malicious code has already executed and replicated. If it did not yet execute, then clear all data stored in your browser that should make you safe. Now as a precaution for the future, you should install a browser, ANY browser IMO, just for the sake of opening untrusted pages. Why is that good? simple: The browser for malicious pages will have its own sandboxing mechanism and thanks to Same Origin Policy and other measures the code will never/rarely be able to leave that sandbox.

For the sake of the code you presented,

ch.frameBorder = ch.width = ch.height = 0

I assume there is a creation of an iFrame with width and height 0, If I would have been the attacker I assume that would be created for clickjacking ;) --

Answer 2

It seems that the Javascript code you shared with us is .... jQuery! :) That's also a reason for why it is so long.

Well it has been minified, so its just awful to read, but I wasn't understand why a possible exploit was playing with everything : form elements, css, dom, etc. But since it's jQuery, it explains everything. (just search on google with some line of the js and you'll find the jQuery minified source).

Now, I can't garantee that the code you couldn't paste was a real exploit, BUT I don't think so.

The reason is simple: It's for the sake of the business of sendshare to assure that they users will come back and maybe use the paid version of their system. If they send you ads that contain virus, this will be known and won't be good for their business.

Now, we're never too sure, and I was going to tell you to check your machine in case you were infected, but you are already doing it, that's good :)

Moreover, since you know where the ad come from, you can look up the name of the ad company in google and see if other users has reported malicious code in their page. It will help know if you are possibly infected or not.

I'm sure you'll be fine and AVG/MalwareBytes won't find any viruses regarding this experience :)

Update: Just a funny update about the BBC - The Documentary, posting a 3 episodes video about ... "Danger in the Download".

Answer 3

First off: You did nothing wrong. Don't castigate yourself. Computers ought to be secure in this situation. Merely clicking on an ad should not be enough to leave your computer with a crippling virus. The fact that today's computers don't always meet this standard, is a poor reflection on us computer scientists.

Now, on to your question. What should you do? Personally, I would do nothing. I wouldn't worry about it. While it is theoretically possible you could have been infected, I think the risk from any one instance like this is not very high, and you're probably exposed to this sort of risk all the time. So I wouldn't stress over this one situation. It's an "oops, maybe I shouldn't have done that, I guess I won't do it again" sort of situation.

If you are concerned, yes, you can do a full scan of your entire hard drive with your favorite anti-virus software and with MalwareBytes. While it is far from perfect, that should be reasonably effective at finding most kinds of malware.

Frankly, the best way to protect yourself against bad stuff happening to you in this sort of situation requires you to be proactive. "An ounce of prevention is worth a pound of cure", and that's definitely true in the computer security realm. If you want to know how you can protect yourself in the future, I recommend taking a few simple steps: turn on automatic upgrades, use anti-virus, set up automatic backups, uninstall Java, don't type passwords or personal information into a site unless you went there yourself by clicking on a bookmark or typing in the address bar, use your browser's password manager. If you want to go one step further, you can install Secunia PSI, to help you ensure that all your software is kept up-to-date.

Answer 4

You were asking for which measures to take and apart from scanning and cleaning, the best tip I can give you is to install AdBlock Plus (or a similar one). Adblocking addons will keep away 99% of the fake download buttons, youtube ads, etc. so IMO it has benefits in terms of both security and surfing pleasure.

Also, like martinstoeckli mentioned noscript is great for security, but it may be too tedious depending on how determined you are. Still highly recommended though.

Answer 5

Just an afterthought, because i'm sure you will encounter this situation again. Make yourself familiar with a script blocker like noscript and whenever you have a bad feeling about a link, you can turn off javascript and have a look at the page. It lists the origins of all scripts and ads, and you can decide which ones you want to trust, or leave the site before any damage is done.