RESOLVED Strange script tries to run when connection is down

[Tom T.]

The typical Goored infection redirects the browser from search engine sites to adware/scumware site

But that did *not* happen here. Both Monty and I could *go* to Google, Ask, etc. without being redirected.

AHA! Because the redirection script was prevented by (drum roll) ... NoScript!

[computerfreaker]

The typical Goored infection redirects the browser from search engine sites to adware/scumware site

But that did *not* happen here. Both Monty and I could *go* to Google, Ask, etc. without being redirected.

AHA! Because the redirection script was prevented by (drum roll) ... NoScript!

Right! And without NoScript, I doubt anybody would have noticed the infection at all...

Thanks so much, Mr. Maone! We white-hats salute you!!!!

[therube]

So is this ZIP'd, posted someplace yet?


Oh, & to search for file (names), there is nothing like Everything search engine!
Locate32 is really nice too, but Everything is just, EVERYTHING.
(Both Windows only. Everything needs NTFS drives.)

The quote nesting is getting a little crazy

A little? Heh.

[Montagar]

I have decided to post just the actual script code that is contained in overlay.xul

The code contains no formatting, so it's just one long string.

Here is the pastebin link: http://pastebin.com/f55f211e9

I have run gooredfix to make sure that nothing remains of this malware.

I have also checked for any suspect dlls and I have used autoruns as well.

[Tom T.]

So is this ZIP'd, posted someplace yet?

http://forums.informaction.com/viewtopi ... 201#p13201

Oh, & to search for file (names), there is nothing like Everything search engine!

]1.3 Does Everything search file contents?

No, "Everything" does not search file contents, only file and folder names.

No one had any trouble locating the overlay.xul once it was known what to look for. What might have helped was something that would search the contents of said file for the string "innoshot", which, to our surprise, someone (either CF or Monty) said Windows didn't search inside certain files. Plus, "innoshot" might not turn out not to be there. Probably obfuscated, and you could redirect by IP. (I posted the IP of innoshot.com earlier: 210.97.228.26.)

Not sure what the advantage of Everything is. All of my Win searches have the Advanced option checked, "Search system folders" and "Search hidden files and folders". If that's still missing something that Everything would catch, it would be interesting to know. Thanks.

[Tom T.]

I have decided to post just the actual script code that is contained in overlay.xul

The code contains no formatting, so it's just one long string.

Here is the pastebin link: http://pastebin.com/f55f211e9

I have run gooredfix to make sure that nothing remains of this malware.

I have also checked for any suspect dlls and I have used autoruns as well.

Wow, that is one *long* string, all right! Good choice not to post it here with code tags.
It will be interesting searching through.

Glad you're safe now. Still need to find out *how* it arrives.

Edit: As suspected, "innoshot" does not appear in that blob. So even a search of file contents wouldn't have located it.

[Tom T.]

Well, here's the smoking gun: (broken into lines so it doesn't run out the screen and into the next room)

Code: Select all

loc=doc.location.href;if(loc_bar.match(/google.*\/(search|cse).*[&\?]q=/)|
|loc.match(/\/search\.yahoo.*search.*[&\?]p=/)|
|loc.match(/ask.com.*\/web.*[&\?]q=/)||loc.match(/bing.com\/search.*[&\?]q=/)|
|loc.match(/aol\/search.*(query|q)=/)){src.search(/(http:\/\/[^\/]+\/)/);var

D'oh, all of us. Instead of searching for "innoshot", we should have been searching for files containing the affected search engines. Google, Yahoo, Bing, Ask, AOL .

[therube]

Free Javascript Obfuscator - Protects JavaScript code from stealing and shrinks size

[Montagar]

D'oh, all of us. Instead of searching for "innoshot", we should have been searching for files containing the affected search engines. Google, Yahoo, Bing, Ask, AOL .

Tom... that was the point of my "I feel dumb" post, I was mad at myself once I saw that the search engines were listed in plain text. We all had figured that the innoshots part would be hidden, but I did search after search after search for bing figuring that would be the most unique not knowing that the OS didn't search the contents of .xul files (and a bunch of others it turns out!).

So ultimately we were searching for the right items, just let down by limited knowledge of the limitations of the Windows XP search function.

[therube]

Don't know if this can help JavaScript Deobfuscator so that you won't have to manually decode each section?

[computerfreaker]

I have decided to post just the actual script code that is contained in overlay.xul

The code contains no formatting, so it's just one long string.

Here is the pastebin link: http://pastebin.com/f55f211e9

Dang it. Somebody sure covered their tracks nicely. Heavily obfuscated, all the way... although de-obfuscating it shouldn't be too hard. I posted a link to a de-obfuscating article recently, just need to find it...

I have run gooredfix to make sure that nothing remains of this malware.

I have also checked for any suspect dlls and I have used autoruns as well.

Sounds good. Glad to hear you're safe now...

Monty, I know you're worried about finger-pointing; would you be willing to PM me (and Tom said he's interested in any PM's you might send his way, too) the name of the addon this code appears to belong to? I would be very happy to make some (highly discreet) analysis of my own, and I sure as heck want to avoid this "legit" addon like the plague if it's guilty... I'm sure everyone else will echo this sentiment.

Wow, that is one *long* string, all right! Good choice not to post it here with code tags.
It will be interesting searching through.

Interesting is right. I'd better break out Sandboxie and Tracemonkey...

Glad you're safe now. Still need to find out *how* it arrives.

Ditto. Montagar, probably the only way we're going to figure this out is with the name of the addon this belongs to... please would you drop us the name in a PM? As always, your PM will be kept strictly confidential...

Edit: As suspected, "innoshot" does not appear in that blob. So even a search of file contents wouldn't have located it.

True. The obfuscation we suspected is there, all right...

Well, here's the smoking gun: (broken into lines so it doesn't run out the screen and into the next room)

Code: Select all

    loc=doc.location.href;if(loc_bar.match(/google.*\/(search|cse).*[&\?]q=/)|
    |loc.match(/\/search\.yahoo.*search.*[&\?]p=/)|
    |loc.match(/ask.com.*\/web.*[&\?]q=/)||loc.match(/bing.com\/search.*[&\?]q=/)|
    |loc.match(/aol\/search.*(query|q)=/)){src.search(/(http:\/\/[^\/]+\/)/);var

The smoking gun, indeed.
More confirmation this is a goored variant - I saw goored code just like this today.

D'oh, all of us. Instead of searching for "innoshot", we should have been searching for files containing the affected search engines. Google, Yahoo, Bing, Ask, AOL .

True... but we had no way of knowing that.
As my Psych teacher used to say, "human hindsight is 20/20; human foresight is much worse"

Free Javascript Obfuscator - Protects JavaScript code from stealing and shrinks size
Sure, looks about right.

D'oh, all of us. Instead of searching for "innoshot", we should have been searching for files containing the affected search engines. Google, Yahoo, Bing, Ask, AOL .

Tom... that was the point of my "I feel dumb" post, I was mad at myself once I saw that the search engines were listed in plain text. We all had figured that the innoshots part would be hidden, but I did search after search after search for bing figuring that would be the most unique not knowing that the OS didn't search the contents of .xul files (and a bunch of others it turns out!).

So ultimately we were searching for the right items, just let down by limited knowledge of the limitations of the Windows XP search function.

And that was the point of my D'oh post, as I know about the Windows Search limitations... I just never thought to apply that knowledge here.
OT: As I was struggling with the Windows search engine again today (this time with NSIS scripts), does anybody know of a better search engine? Everything only searches file & folder names, so that won't work... (or would locate32 do the trick?)

Oops, missed one.

[quote="therube"So is this ZIP'd, posted someplace yet?

Montagar posted the source for overlay.xul on pastebin... http://pastebin.com/f55f211e9

Oh, & to search for file (names), there is nothing like Everything search engine!
Locate32 is really nice too, but Everything is just, EVERYTHING.
(Both Windows only. Everything needs NTFS drives.)

Unfortunately, Everything only searches file names... does Locate32 search file contents too? (Sorry, can't check right now - I'm in a bit of a hurry)

The quote nesting is getting a little crazy

A little? Heh.

Well, with 145 posts or so on the same topic, what would you expect?

L8R, guys!

PRE-SUBMISSION EDIT: therube just posted again, better reply as I can maybe save everyone some time.

Don't know if this can help JavaScript Deobfuscator so that you won't have to manually decode each section?

you know, I actually have that addon... haven't used it as I haven't needed it, but now would be a good time.
I'll see if I can get that to work on that overlay.xul file - it might not, but then again, who knows...
(and yes, I'll be using Sandboxie... I'm actually still a little afraid of this thing, which is probably just as well)

[Montagar]

Oh, I do need to clear something else up, I was able to determine that this code is not part of any of the add-ons that the "named" developer has on mozilla.org... it appears that someone has placed a particular developers copyright info in this .xul file to make it appear that it is his code.

I confirmed this by installing the add-ons in question on a separate computer (with a fresh OS install) and checking everything that was installed/changed. I also looked at the code associated with the add-ons themselves.

I will sleep on the question of sending the rest of the info to Tom and computerfreaker via pm.

[Tom T.]

D'oh, all of us. Instead of searching for "innoshot", we should have been searching for files containing the affected search engines. Google, Yahoo, Bing, Ask, AOL .

Tom... that was the point of my "I feel dumb" post, I was mad at myself once I saw that the search engines were listed in plain text. We all had figured that the innoshots part would be hidden, but I did search after search after search for bing figuring that would be the most unique not knowing that the OS didn't search the contents of .xul files (and a bunch of others it turns out!).

So ultimately we were searching for the right items, just let down by limited knowledge of the limitations of the Windows XP search function.

SOLVED!
http://www.pcl-online.org/watchetsoft/h ... tfind.html

WatchetFind! - search the contents of text files - even under Windows XP

Free utility - fast text search - through selected drives/folders/file types

Speeds up text searching. Particularly useful for XP users who may find they can't search certain types of files.

Originally developed for our own in-house use on Windows XP machines where the operating system prevents searching certain file types.

WatchetFind! is a very fast text-search utility offering drive/folder searching - selecting by file type - choose case sensitive/insensitive, whole word search and nested folder tree options.

(emphasis mine).
I just d/l this, scanned for virus, OK, installed.

I then created a file called test.xul, containing the singe word, "google". Buried it several folders deep in some random folder. Searched for "google" and it found the .xul file "immediately" -- plus many Fx .js files with "google" inside, because the code is credited to Google or to someone from Google. None of which, presumably, would have been found under the standard XP search.

Unfortunately, it doesn't appear to support Vista+, as it was dated 2003 -- but it *might*. Only 1.29 MB installed. Very user-friendly.

Using this tool to search "google", "ask", etc. would have found the miscreant file very quickly.

I'm going to duplicate this post in Web Tech, for more general dissemination. Super-valuable tool for us malware hunters, eh?

[computerfreaker]

Oh, I do need to clear something else up, I was able to determine that this code is not part of any of the add-ons that the "named" developer has on mozilla.org... it appears that someone has placed a particular developers copyright info in this .xul file to make it appear that it is his code.

The dirty rats... they sure went out of their way to cover themselves.

I confirmed this by installing the add-ons in question on a separate computer (with a fresh OS install) and checking everything that was installed/changed. I also looked at the code associated with the add-ons themselves.

Well, I'm glad the "named" addon isn't responsible; regardless of the addon, a malicious addon on mozilla.org would really cause a stink.

D'oh, all of us. Instead of searching for "innoshot", we should have been searching for files containing the affected search engines. Google, Yahoo, Bing, Ask, AOL .

Tom... that was the point of my "I feel dumb" post, I was mad at myself once I saw that the search engines were listed in plain text. We all had figured that the innoshots part would be hidden, but I did search after search after search for bing figuring that would be the most unique not knowing that the OS didn't search the contents of .xul files (and a bunch of others it turns out!).

So ultimately we were searching for the right items, just let down by limited knowledge of the limitations of the Windows XP search function.

SOLVED!
http://www.pcl-online.org/watchetsoft/h ... tfind.html

WatchetFind! - search the contents of text files - even under Windows XP

Free utility - fast text search - through selected drives/folders/file types

Speeds up text searching. Particularly useful for XP users who may find they can't search certain types of files.

Originally developed for our own in-house use on Windows XP machines where the operating system prevents searching certain file types.

WatchetFind! is a very fast text-search utility offering drive/folder searching - selecting by file type - choose case sensitive/insensitive, whole word search and nested folder tree options.

(emphasis mine).
I just d/l this, scanned for virus, OK, installed.

I then created a file called test.xul, containing the singe word, "google". Buried it several folders deep in some random folder. Searched for "google" and it found the .xul file "immediately" -- plus many Fx .js files with "google" inside, because the code is credited to Google or to someone from Google. None of which, presumably, would have been found under the standard XP search.

Great!!
Thanks for finding that, Tom!
I'm going to pick it up immediately and stop pulling out my hair over XP's search...

Unfortunately, it doesn't appear to support Vista+, as it was dated 2003 -- but it *might*. Only 1.29 MB installed. Very user-friendly.

Well, does anybody with Vista or Windows 7 want to try this out? (I'd do it, but I've never even used a Vista/7 box - the highest I've gotten is XP SP3)

Using this tool to search "google", "ask", etc. would have found the miscreant file very quickly.

True... 20/20 human hindsight again.

I'm going to duplicate this post in Web Tech, for more general dissemination. Super-valuable tool for us malware hunters, eh?

Super-valuable tool, period!
Even in normal, everyday computer use I could utilize something like this... I've been getting fed up with XP's search lately, but AFAICT this takes care of all XP's search issues...

[Tom T.]

Well, I'm glad the "named" addon isn't responsible; regardless of the addon, a malicious addon on mozilla.org would really cause a stink.

Yeah, I was thinking that too. Now we just need to find out how they evaded Guardian's very firm opinion that it would have shown up somewhere in the Add-ons/Extensions list. Some new obfuscation technique?

Re: Vista: I have a machine that came with Vista+XP "downgrade" (read, "upgrade" ) rights. Of course, it was immediately changed to XP. If no one with a native Vista/7 installation wants to try it, I could re-install Vista long enough to install this tool and test it, then use my disk-image backup to get back to where it was. It would be a lot faster if someone running these systems already would try it, though.

@ CF: Does the one you found support the newer systems?

Edit: ComputerFreaker's tool appears to support up through 2008, which would include Vista.

therube's link in his post at the Web Tech topic, "Freeware-guide: File Searching", has numerous file-searching utilities, some of which support "all" Windows. So there's something for everyone. Don't know why this didn't come up before, but now everyone should be able to search for text *and* binary in *any* file, with a multititude of freeware tools available.