1

I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script

<script src="https://engowe.com/ad.php?u=e38324c56607a8891ad6496ae98e66a1&c=gpupdater&p=1"></script>

Placed just before the closing of </head> which leads to this code

My attention was drawn to it by the unescaped ampersands, and I had no memory of putting it there. Checking the source code I found no existence of this script.

I have found this script in other pages of mine, but am not sure what it does, or where it comes from, nor how to go about doing so. The only external javascript libraries I am using are JQuery and modernizer, neither of which I would expect to do this.

More alarming, looking at the sources of my sites resources show a sleuth of material I have no knowledge of. This is particularly perplexing on a static site which, is not live, and has no plugins or external media! At the very least it is putting a significant drag on loading the site (particularly due to a lack of response from a "linkr.us" server), but more to the point I am concerned about security vulnerabilities on my other sites.

How do I go about tracing the origin of what I can only assume is malicious code?

sources

Improve this question
3
  • It sounds more likely that this script is being added by some malware maliciously installed in your browser. Do you see the same script in the source code of other websites? Are you able to test your site using another web browser (ideally from another machine)? If you're on Windows you might want to run a full scan with Windows Defender.
    – Tim Fountain
    Jul 12, 2015 at 22:17
  • @Tim brings up a valid point. Have you checked the files on your server directly and not with a browser? Can you shell in and edit your files to see if they have been compromised? If the files on your server have been compromised, then your site has been hacked which is very possible even with a static site. If the files are not compromised, then it is likely that your local computer has been hacked with adware or other malware.
    – closetnoc
    Jul 12, 2015 at 23:05
  • @closetnoc Although I initially dismissed browser specific malware (as I had recently done a clean sweep and did testing from a couple of browsers) the problem ultimately seems to be machine specific. Curiously, however, this injection seems to only take place when the site is accessed through the loopback address, as opposed to simply viewed on the machine on which it is stored.
    – Stumbler
    Jul 13, 2015 at 12:18

3 Answers 3

Reset to default
1

This is almost certainly injected into pages on your own machine. Various malware, once installed, adds itself to loaded pages in order to affect the functioning of the page (generally by replacing ads with its own ads so the authors can collect the click revenue). See this question for more info.

To test, check the actual server files, or use cURL or a similar tool to directly retrieve the files. If the server files are fine, try from a completely different machine and see if the code is also injected there.

Improve this answer
4
  • although I do not believe it to be the case here; surely the injection could take place at runtime, making the checking of such source files to be in no way a guarantee in of itself?
    – Stumbler
    Jul 13, 2015 at 12:21
  • That would require compromising the web server itself, which is a hard thing to do unless you have root access to the server. With root access, there are far more fun things you could do to earn money taking over a server (e.g. server your own websites, send spam, be a command center for a botnet, etc.)
    – Daniel Griscom
    Jul 13, 2015 at 13:00
  • Actually, compromising the web server is relatively easy to do- especially with PHP and/or Java installed. You do not have to have any PHP or Java code at all- it is often the environment that let's you in. As well, DNS, FTP, SMTP, POP or POP3, can easily be vulnerable. Some databases too. Oh and let us not forget some versions of the web server. You do not need root access to gain root access through a vulnerable application.
    – closetnoc
    Jul 13, 2015 at 13:45
  • Well, given this is a "static" website, how would his HTML be compromised between being read from the disk and being sent to the client? And again, I'll say that if you have write access to someone's file system, there would be far simpler ways to accomplish nefarious things.
    – Daniel Griscom
    Jul 13, 2015 at 19:10
1

I was also infected by this. It is some malware that install Privproxy (www.privoxy.org) listening on the TCP port 8118 that injects JavaScript line into every HTML page, and it also set the Windows system proxy setting to localhost:8118. Just disable the proxy setting and uninstall Privproxy.

Improve this answer
1
  • I removed a link to that site since we don't want to give anyone who does this free publicity.
    – John Conde ♦
    Sep 6, 2015 at 18:56
1

I had similar issue with tracking code that is injecting js malware. It was loading from https and when I added address of that domain to my hosts file with my localhost (127.0.0.1) ip.

Google Chrome started to throw error net::ERR_CERT_AUTHORITY_INVALID with a line of loading script.

so this trick let me track script down which was inserting malware.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.