RESOLVED Strange script tries to run when connection is down

[Montagar]

Hi all,

I have found a strange script that attempts to run when my connection is down and I attempt to go to a specific web site. Here are the details (I have only found two sites so far that it happens with).

http://www.google.com - Scripts Curretnly Forbidden 0/1 () | <SCRIPT>:4 | <OBJECT>:0 - Allow innoshots.org
http://www.yahoo.com - Scripts Curretnly Forbidden 0/1 () | <SCRIPT>:3 | <OBJECT>:0 - Allow innoshots.org

I did a search for innoshots.org and couldn't find anything, although it is a valid domain. I can attempt to access other sites and the script doesn't try to run. They may be others, but so far those are the only two that it happens with. I first noticed this when my connection was down, but I have continued to test it by having my firewall locked.

Any thoughts?

Thanks.

[Tom T.]

Interesting.
When trying to connect to Google with the wireless shut off, I get scripts trying to run from innoshots.com, not .org, and also innoshot.com (singular).
Trying to connect to innoshots.org gives a 403 forbidden message.

Innoshot.com is an Asian website, entirely in Asian. Innoshots.com tries to do a redirect, probably to innoshot.com, but the redirect is blocked by NoScript.

Sometimes, invalid URLs will redirect to an ad page instead of to a standard 404 error message, but that's just your ISP trying to make money from your mistakes.
I don't immediately see how attempting to go to Google, or anywhere else, without an Internet connection could cause scripts to try to load. If I'm not connected to the Internet, where is the script coming from? Surely not built into Fx...

Edit: And if I do allow the script while the connection is still off, a new page does look like it's trying to load. It can't, of course.
In the meantime, you're safe, with NoScript blocking the scripts anyway.

That's a head-scratcher. Giorgio? Anyone?

[Montagar]

Well, add www.yahoo.com and www.ask.com to the list of sites that it happens with. Very strange that they are all search engines, although it doesn't happen with www.altavista.com or www.lycos.com

[Tom T.]

Well, add http://www.yahoo.com and http://www.ask.com to the list of sites that it happens with. Very strange that they are all search engines, although it doesn't happen with http://www.altavista.com or http://www.lycos.com

Montagar, thanks for the reply. The OP did have yahoo included, and actually, that's their home page or portal, if you will, and the search is only a small part of it. It also doesn't happen at http://www.scroogle.org nor at the secure version, https://ssl.scroogle.org/. But that's a "clean" site, designed specifically to stop Google's cookies and profiling of searchers. It has javascript, but you don't need to allow it to be able to use the site.

Interesting that ask.com does it too.

Edit: It doesn't happen at http://www.bing.com, Microsoft's search engine.

[Giorgio Maone]

A rogue add-on, maybe?
Can I see your add-ons lists?

[Montagar]

That certainly makes sense that it would be an add-on trying to run the script. Here is a list of the add-ons that I have installed.

adblock plus 1.1.1
cacheviewer 0.6
cookiebuller 1.3.1
fireftp 1.0.6
greasemonkey 0.8.20090920.2
ie tab 1.5.2009.0525
noscript 1.9.9.12
pixlr 1.2
sqlite manager 0.5.6

[therube]

Certain websites/malwares react differently depending upon how you accessed them, depending upon what the referrer is.

I.e., you can load a webpage, www.goodwebpage.com directly by typing the address into the URL bar without a problem.

But if you were to "open" the same page from a Google search - which would set the referrer to www.google.com, then www.goodwebpage.com responds differently, loading a malware page instead. (Actually it is the hosting service's servers that have been hacked & not goodwebpage itself.) In most instances like this, you can add live.com & yahoo.com & (usually altavisata too) as referrers that would trigger this.

Perhaps you are running into something similar?

[therube]

when my connection is down and I attempt to go to a specific web site

When trying to connect to Google with the wireless shut off

How does anything happen in these instances except for an eventual timeout?

[Montagar]

How does anything happen in these instances except for an eventual timeout?

The script is not being generated by anything on the Internet, it's being generated by something that is part of FF (most likely an add-on).

[therube]

OK. Then try a contents search of the files in your extensions directory tree for the string 'innoshot' & see if anything turns up. (Could be plugin related too, I suppose?)

[Giorgio Maone]

That certainly makes sense that it would be an add-on trying to run the script. Here is a list of the add-ons that I have installed.

adblock plus 1.1.1
cacheviewer 0.6
cookiebuller 1.3.1
fireftp 1.0.6
greasemonkey 0.8.20090920.2
ie tab 1.5.2009.0525
noscript 1.9.9.12
pixlr 1.2
sqlite manager 0.5.6

The only apparent suspect in this list is GreaseMonkey, if you're running any "Google enhancer" userscript.

[Montagar]

That certainly makes sense that it would be an add-on trying to run the script. Here is a list of the add-ons that I have installed.

adblock plus 1.1.1
cacheviewer 0.6
cookiebuller 1.3.1
fireftp 1.0.6
greasemonkey 0.8.20090920.2
ie tab 1.5.2009.0525
noscript 1.9.9.12
pixlr 1.2
sqlite manager 0.5.6

The only apparent suspect in this list is GreaseMonkey, if you're running any "Google enhancer" userscript.

Actually, I have GreaseMonkey disabled but included it in the list to be complete. I was planning on removing it, so I will just do that and test again.

[Montagar]

GreaseMonkey is gone and the script is still trying to run.

Just to make something clear, the script attempts to run with my internet connection on when I go to those web sites as well. I just originally assumed the script was of those specific sites (which I now know it is not).

[Giorgio Maone]

Does it happens when you disable all your extensions as well?
Have you got any proxy / personal firewall?

[Montagar]

Does it happens when you disable all your extensions as well?
Have you got any proxy / personal firewall?

I use Comodo firewall... I will have to do a test with all of the extensions disabled, and then enable them 1 by 1 to see which one it is (if any).