I have a website I host that uses jquery hosted with google cdn from https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

One of my users is complaining the site doesnt work for them. I got them to look in the developer console and they had some error with jquery.min.js so I got them to open the link in a new tab and send me the file. In the bottom of their file is some script that trys to post data to adloads.net but the //# sourceMappingURL in the jquery.min.js causes a javascript error.

I assume they have some malware browser plugin or maybe a virus that injected the extra script into their browser cache.

Is there some way I harden my website so it is not broken for this type of malware? What advice should I give the user?

edit: since posting this I learned about the integrity attribute - it doesn't fix the site for these users but I feel it should be used on external resources: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity

2 Answers 2


No. There is nothing you can do about a user's computer program, even if that program is malware.

As requested: A malware program is a program like any other program running on a user's computer. A web site has no control over the input or output of that malware program or the program itself in the same way that a web site cannot control your installed copy of Microsoft Word. Nor would you ever want that possibility.

In order to respond to a malware program in a different way, just to satisfy a visitor who, apparently, has decided to keep the malware on their system instead, means one needs to understand how the malware works and responds to input in order to re-code their site to respond to that malware on that one computer in a different way that will be unique to that one visitor.

Further discussion into the thought of that will only get me banned from this site.

  • That's not true. Keeping software up to date is the first step.
    – Steve
    Commented Jan 1, 2017 at 4:15
  • This was flagged as low quality by the system. Can you explain just a bit more of what you mean? Cheers!!
    – closetnoc
    Commented Jan 1, 2017 at 5:03
  • 1
    @Steve First, you explain to me how a web site can control the input and output of a computer program, and the program itself, running on a user's computer.
    – Rob
    Commented Jan 1, 2017 at 13:19
  • @Rob OK, I misinterpreted your answer, but why do you even mention "computer program"? The OP only talks about a website and malware
    – Steve
    Commented Jan 1, 2017 at 22:49
  • @Steve Malware is a running program no matter what it's called.
    – Rob
    Commented Jan 1, 2017 at 23:45

As Rob suggests, a user's computer is ultimately the responsibility of the user. The best you can do is to make sure your site is secure and not vulnerable to any kind of attack the user's malware infested, virus ridden computer might throw at you (if that really is the case).

If you were able to detect malware on the user's machine then you'd probably want to block that user (if anything), rather than somehow making your site appear immune.

Is there some way I harden my website so it is not broken for this type of malware?

This "malware" appears to be modifying an external resource (JavaScript file). You would need to verify that the contents of the downloaded resource is as expected, perhaps by comparing the contents with some precalcuated hash? But an integrity check (or script signing) of this nature would ideally need to be built in to the browser, rather than home grown.

See this question on StackOverflow:
How can I make sure that my JavaScript files delivered over a CDN are not altered?

However, what exactly is "this type of malware"? It could, theoretically, be doing anything. Injecting code directly into the page, requesting additional resources, etc. etc.?

There are also legitimate browser extensions that modify the HTML source.

What advice should I give the user?

The usual... virus/malware scan. Try a different browser. Try a different computer on the same network.

so I got them to open the link in a new tab

Presumably this "link" was sent to them separately (or verified in some way)? It wasn't grabbed from the page source / developer tools, as otherwise it doesn't necessarily rule out your site being hacked.

  • yes I asked them to open in new tab from the developer console Commented Jan 3, 2017 at 3:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.