RESOLVED Strange script tries to run when connection is down

[Tom T.]

Well, I understand you are (thinking on your feet), and at this point I'm ready to try anything and look anywhere. So I just checked my userChrome file, which I've never touched, and sure enough, it's still in its virgin state as userChrome-example.css. No anomalous entries inside, either.

So I'm just suggesting that there might be other things we all should be spending our time on, unless and until we get some more hard data to work with.
Maybe it'll disappear for the other reporters, too. Sure, we'd like to know, to satisfy curiosity if nothing else, but we're spinning our wheels until more confirmed reports come in, and we can query the reporters about all these things.

Or maybe I'll be able to reproduce it again, and give it a more thorough going-over. Or it'll hit you, or Giorgio -- hope not.
Let's give it a rest, Bro, until there's more to go on.

[GµårÐïåñ]

Yessum!

[Tom T.]

Hey, I didn't mean to spoil your fun! If it floats the boat, go for it!

[therube]

If you were talking to someone

In that context, I was thinking more as GµårÐïåñ described above. Communications going on without your knowledge. A rootkit or whatever.

given its entirely located within Asia

I kind of got a CZ feel about things when I was looking yesterday in addition to Asia.

why would it mysteriously disappear?

the particular site is now down ... to be up later ... or to be rerouted to another domain name ...

[Montagar]

I did a content search for "innoshot" and didn't find anything. BTW, I am the OP.

I have NoScript 1.9.9.12, I will update to 1.9.9.14

I have scanned with Avast anti-virus, Ad-Aware and Malwarebytes and haven't found anything.

Is there any chance that an add-on or plugin is running, but doesn't show up in the FF "list"?

[therube]

Is there any chance that an add-on or plugin is running, but doesn't show up in the FF "list"?

Yes.

[Giorgio Maone]

Is there any chance that an add-on or plugin is running, but doesn't show up in the FF "list"?

Yes, it is (still) possible, but at this point something external to the browser (a proxy, an hijacked DNS or a rootkit) is more likely.
Could you use View|Page source on the page showing the additional scripts, both in Firefox and in a different browser (e.g. Chrome)?

[Montagar]

Yes, it is (still) possible, but at this point something external to the browser (a proxy, an hijacked DNS or a rootkit) is more likely.
Could you use View|Page source on the page showing the additional scripts, both in Firefox and in a different browser (e.g. Chrome)?

I have saved the page source for http://www.google.com using both FF and Chrome. The files are different, but I don't know if that is to be expected because of the different browsers. There is no reference to innoshot in either of the files.

I there something specific to look for?

[Giorgio Maone]

I there something specific to look for?

No idea. Could I look at them?

[Montagar]

No idea. Could I look at them?

Here is the FF file:



Here is the Chrome file:

[Giorgio Maone]

Would you mind to use a decent service like http://pastebin.com?
Thanks.

[therube]

Google: http://pastebin.com/m589feddd

Chrome: http://pastebin.com/m3ff876a2

hidden iframe

(function(){for(var
d=0,c;c=["ad","bc","p","pa" ...

<script>function _gjp() {!(location.hash && _gjuc()) &&
setTimeout(_gjp,
500);}google.j[1]={cc:[],co:['ghead','body','footer','xjsi'],pc:[],nb:0,css:document.getElementsByTagName('style')[0].innerHTML,main:'<span
id=ghead> ...

Got me as to what it may mean.

[Montagar]

Sorry, thought you just wanted the raw files.

FF:

http://pastebin.com/f2775659f

Chrome:

http://pastebin.com/f62ca5015

[Giorgio Maone]

Sorry, nothing from those files.
Could you install Adblock Plus and check if anything from innoshot is shown in the "Blockable Items" panel?

[Montagar]

I already have Ad Block Plus installed, but stupid me never thought to look at the blockable items list, good call on your part!

Here are the questionable scripts that are trying to run (I have disable auto URL parse in this post and also removed the beginning "h" just to be safe):

ttp://29.innoshots.org/jq.js

ttp://29.innoshots.org/live.php?n=26606B673930206A616D37783C3F3F382026222A32607F73255D2E5E595B2F2E131964111D1114131E1168131919166D02000570720506730A1F59574A584C027771642220287B766E26393D293F737A7E60743F3027093265687C3830332A00055C53451353525A584F2F243E

EDIT: I just noticed that although the complete text of the second URL is still in the post, it does not display all of it.