InformAction Forums

The code is correct. It gets execute on any non-https page, because the popunder scripts in the wild are extremely polymorphic, often inlined and therefore that's no way to know in advance whether a page will execute them. If the pseudo-cookies (which, BTW, are never sent to the server side because...

by completely script-allowed do you mean trusting all scripts even external ones? At least that's the behavior I'm getting. so the sources value is the regex expression to find the replacement is the code it will replace it with, right? see http://hackademix.net/2011/09/29/script-surrogates-quick-r...

Whoa. It's true. This does happen. On *this page*, using Firebug (not logged in): >>> document.cookie "style_cookie=printonly; popunder=yes; popundr=yes; setover18=1" But I can't reproduce it anywhere else (yet), and those cookies don't show up in Advanced Cookie Manager or Data Manager.....

Thrawn wrote:Just to be clear, this isn't happening for the rest of us.

Have you scanned your system for malware?

I made a scan with avast and now i running clamav but nothing yet...

How are you determining that the cookies are appearing? document.cookie variable If you disable all other extensions, maybe Plugins too, except for NoScript, do you still get the cookies? yes As a test, if you create a new Profile & only install NoScript into it, do you still get the cookies? y...

I got it from the first link...

I have been using NS for a while and every time i use it i get 3 cookies on all domains.
popunder=yes; popundr=yes; setover18=1
I can't remove them and they are only present when i enable NS.