2

I'm on a page that is exhibiting some malware, in the form of this code being run when I click the link to http://www-users.york.ac.uk/~raa110/audacity/AudacityHelp.html#DMA -- which has been a 404 since my first try but the malware injection occurs before that page is even opened:

(function(){var f='www.super-resume.com/#__';f='https://href.li/?http://'+f;function hasLocalStorage(){try{localStorage.setItem('a','a');localStorage.removeItem('a');return true}catch(e){return false}};if(!document.addEventListener||!hasLocalStorage())return;var g=window.has_more_ads||window.has_st||(document.referrer&&document.referrer.match(/(:\/\/www\.(google|bing)\.|search\.(yahoo|ask)\.com\/)/i));var h=!document.location.href.match(/^http:\/\/(spssx-discussion|rhodes--22|vtk\.1045678|itk-users\.7|astronomia-e-astrofotos\.1069742|jsmastronomy.30143|jsmtst.2343515)\./);var j=!Nabble||!Nabble.isEmbedded;if(!g||!h||!j)return;if(!localStorage.dwp){$('td.footer-right').prepend('<span id="dis'+'ablep'+'op0"><a id="dis'+'ablep'+'op1" href="javascript:void(0)">Disa'+'ble Po'+'pup A'+'ds</a> | </span>');$('#dis'+'ablep'+'op1').click(function(){localStorage.dwp=1;typeof notice=='function'&&notice('Po'+'pup ads have been dis'+'abled',3000,1000);$('#dis'+'ablep'+'op0').remove()})}var k=localStorage.st;var l=new Date().getTime();var m=60*60*1000;var n=!k||l>parseInt(k)+m;if(!n)return;var o='width=1,height=1,left='+(screenX+outerWidth/2)+',top='+(screenY+outerHeight/2);function safari_trigger(){document.removeEventListener('click',safari_trigger,false);var a=window.open(f,'pu_',o);var b=document.createElement('a');b.setAttribute('href','data:text/html,<scr'+'ipt>window.close();</scr'+'ipt>');b.style.display='none';document.body.appendChild(b);var c=document.createEvent('MouseEvents');c.initMouseEvent('click',true,true,window,0,0,0,0,0,true,false,false,true,0,null);b.dispatchEvent(c);document.body.removeChild(b)};function firefox_trigger(){document.removeEventListener('click',firefox_trigger,false);var a=window.open(f,'pu_',o);if(a){a.blur();try{var b=a.window.open('about:blank');b.close()}catch(i){};window.focus()}};function simple_trigger(){document.removeEventListener('click',simple_trigger,false);var a=window.open(f,'pu_',o);if(a){a.blur();window.focus()}};function chrome_trigger(b){var a=b.currentTarget;var c=a.href;a.href=f;window.open(c,'_blank')};function ready(a){if(document.readyState!='loading')a();else document.addEventListener('DOMContentLoaded',a)};ready(function(){var a=navigator.userAgent;var b=a.indexOf('Chrome')>=0?chrome_trigger:a.indexOf('Firefox')>=0?firefox_trigger:a.indexOf('MSIE')>=0||a.indexOf('Trident/')>=0?chrome_trigger:a.indexOf('iPhone')>=0?chrome_trigger:a.indexOf('Safari')>=0?safari_trigger:false;if(b){var c=document.querySelectorAll('a');for(var i=0;i<c.length;i++){var d=c[i].getAttribute('href');if(d&&d.indexOf('javascript:')==-1){function _wrapper(e){localStorage.st=l;if(localStorage.dwp==1)return;b(e)};c[i].addEventListener('click',_wrapper,false)}}}})})();

It opens a tiny window and pretends to click various things, I guess to simulate real user browser clicks in order to scam ad revenue. As soon as you click this pop-under's taskbar entry to investigate, it closes.

My question is, what's injecting this? I doubt nabble.com has the malware, nor York U's 404 page; plus I cannot reproduce this behaviour in a private window. The developer pane just says it's anonymous (I captured this by clicking the pause symbol, then the link you can see on the page):

malware caught during click

I don't have any strange plugins or addons, just what comes with stock Firefox, plus zotero and adblock plus, none of which have caused me problems before.

Firefox 51.0.1 (32-bit) on Windows 8.1 64-bit.

update

After a computer and browser restart, returning to the nabble page, pausing the debugger, and clicking the link now shows many sources, but still a SOURCE0, but it doesn't seem to have malware (or it's different malware): http://pastebin.com/zJi6P5Ay

update 2

Spybot Search & Destroy did not find anything related to super-resume.com or any malware--just tracking cookies and recent file lists.

update 3

Programs and Features does not show anything suspicious--only things installed on purpose and nothing extra. The most recently installed program (a day or two ago) was Spotify--and I found this link (can't post, not enough rep, but second match on google for 'malware from spotify installer', FROM SPOTIFY COMMUNITY FORUMS) but they're supposed to have fixed that problem already. Plus I can't see why they would be injecting in existing windows' click handlers--that link describes more a pattern of just opening new browser windows whenever Spotify likes to, not whenever the user clicks something on an unrelated web page.

closed as primarily opinion-based by Julian Knight, Steve, Matthew, Xander, Rory Alsop Feb 11 '17 at 19:16

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    I'm afraid that doesn't make sense. That non-existent page redirects to a 404 page that doesn't contain malware. If you are seeing something different, it must be a local issue, most likely something infecting your browser. – Julian Knight Feb 10 '17 at 13:00
  • 1
    I think it would help to make the question rather more clear. Just because you cannot see the malware, doesn't mean it isn't there. You should run a malware check/clean application or two which will likely find the issue. – Julian Knight Feb 10 '17 at 13:05
  • 1
    That code is being injected which is why you cannot make sense of it. You can prove that by accessing the URL via a different browser or using something like wget on it. There are many ways that can happen and unless you are a security researcher, it is a waste of your time and energy. – Julian Knight Feb 10 '17 at 13:16
  • 1
    While Windows Defender is a reasonable tool, it is far from perfect and certainly doesn't find most PuP's and similar annoyances. Malwarebytes, et al are the tools to use. – Julian Knight Feb 10 '17 at 13:17
  • 1
    The originating page has 8 JS libraries of which 5 are trackers +1 AJAX call. None contain your offending script as far as I can tell & I get nothing when going to that page and clicking on the link so the issue is definitely local to you. If the anti-malware tools don't find it, I suggest, as before, using a different browser, if that is clear, you will have to reset the browser - possibly by deleting it, removing any remaining settings and then reinstalling. – Julian Knight Feb 10 '17 at 13:44