0

Today, I noticed that almost all of my web project (published or in localhost) have a set of weird script references in their pages:

mgicinjs.info script references

And they are all automatically generated - they don't appear in View -> Page Source, but they are visible in Inspect Element -> Elements tab.

This behavior is what a malware does. However, I search around and no virus indexes like VirusTotal say that it's a virus. What makes it really suspicious, is that all search results about it (mgicinjs.info) is about URL and domain virus scanners!

I don't know where it came from and how can I remove it.

3

I figured it out!

it's not virus

Here is how i resolve it below:

open savefrom.net button

1. open savefrom.net setting.

uncheck offers4u

2. uncheck "Offers4U" feature.

If you are curious, it's because Offers4U from savefrom.net extension

done. i hope it helps. :)

  • 1
    Technically speaking, this is not a virus. However, this type of utterly useless bundled software is classified by AV vendors as "Potentially Unwanted Programs" (or PUPs). It is considered as special type of malicious software that carries special legal properties, requires politically-correct (oh, sorry, I meant legally-compatible...) name and demands dedicated option in AV scanners for enabling its detection. But by the matter of hard facts (I'm politically incorrect now...) it's still all the same: good-old malware. – Van Jone Jun 14 '16 at 23:08
2

I found it.

It's not a virus. These files are added by SaveFrom.net Chrome extension. I opened all of my sites by IE and see no sign of those scripts as that extension is not present in IE.

1

They seem to go away when disabling "Offers4U" in the SaveFrom.net extension settings (at least in my Firefox). So it seems they are a kind of adware. I don't think the extension had it when I originally installed it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.