[Resolved] Using Noscript while opening links in your email

[mades]

I have a question about how noscript operates within the confines of email providers. (Not sure if which forum this goes into. My apologies if I chose the wrong one).

I opened two emails (using Gmail). Supposedly one was from Zendesk (the other I did not realize was from another source. Attention was elsewhere). Anyhow, I clicked on the unsubscribe button. Normally, this a good policy for legitimate sources.

In this case, I clicked on the one from the supposedly non-legitimate source. I was wondering, since I have noscript on at all times, could I possibly get infected? All I got was a spinning circle (in the tab) with the new tab internal address.

Note: I obviously have the scripts enabled for my email provider. But not for random websites.

According to the Zendesk email, they claim that the person/group had some malware. Something about a file or something. Now, I have zero clue whether that email itself is legitimate at this point. Have I dealt with Zendesk in the past? Yes. With which email account? I cannot remember.

In any event, the email does not come with an attachment as Zendesk claimed it would. Anyhow, this is what they wrote, well a snippet anyhow:

Your computer(s) may be infected with a virus if you recently:

Opened a file from "Joyce Lim" named "info.xls", "information.xls", "infos.xls", "mail.xls", "market.xls", or "marketing.xls" related to a job opening entitled "Need mail and other lead generation consultation." Enabled macros from the file, or already had your macros enabled

I am currently running MBAM, and will run superantispyware afterwards, and then Avast. Finally, I will run norton power eraser.
I am also always running Threatfire, which tells me of unauthorised connections to the internet. Had some pop up.

[barbaz]

Did you (Temp-)Allow the attacker's site in NoScript?
Do you have "Temporarily allow top-level sites by default" or "Allow Scripts Globally" set?

It sounds like your answers are no and no - as in, the attacker's site was blocked from running any active content. If that's the case, your malware infection is likely NOT from that email link and you should look elsewhere for the source.

[mades]

Oh no. All my script are denied by default, and top-level sites option is off. I only allow scripts I know are safe (like gmail's). Basically, I clicked on a link in my gmail account without thinking about what I was doing. All it did was open a new tab and load a page. Or at least, tried loading a page.

I don't actually have any malware. At least, not prior to this scare anyhow. I was just trying to figure out whether or not clicking on a link, while using noscript, would be able to activate malware from within a gmail email. But then, I was afraid, since gmail's scripts are active. I wasn't sure if noscript would understand the difference between gmail's allowed scripts, and the blocked script from a page that was trying to load.

[barbaz]

NoScript allows scripts by where they are hosted. Clicking a malicious link won't by itself allow the attacker's scripts to run.

[mades]

Great to know! I wasn't sure about that part with noscript. Gotta love noscript

Thanks for your quick response.

[barbaz]

You're welcome!