Script with random letters and numbers

[Niklas]

https://imgur.com/wyQwW36

What is that script with random letters and numbers? I get in on many sites at random times.

[barbaz]

scan your system for malware per General Troubleshooting Instructions #2

[Niklas]

scan your system for malware per General Troubleshooting Instructions #2

I have scanned my computer with malware removal/antivirus software, got nothing.

[barbaz]

Are you on some sort of proxy, or could you maybe being subjected to MITM attacks? (Does it show up on HTTPS sites, e.g. this forum?)

Any odd extensions listed in the Add-ons Manager and/or about:support ?

Can you do a DNS lookup of the "domain" and post here the results?
(Used to be done in Network Utility in older OS X versions. If Network Utility doesn't exist in 10.11, open Terminal.app and use dig - e.g. for the one in your screenshot, enter this command: )

Code: Select all

dig gdprjtb

[barbaz]

I have scanned my computer with malware removal/antivirus software, got nothing.

Out of curiosity, what software did you use?

[Niklas]

Are you on some sort of proxy, or could you maybe being subjected to MITM attacks? (Does it show up on HTTPS sites, e.g. this forum?)

Any odd extensions listed in the Add-ons Manager and/or about:support ?

Can you do a DNS lookup of the "domain" and post here the results?
(Used to be done in Network Utility in older OS X versions. If Network Utility doesn't exist in 10.11, open Terminal.app and use dig - e.g. for the one in your screenshot, enter this command: )

Code: Select all

dig gdprjtb

It shows the most up on youtube and HTTPS is used there.
https://imgur.com/a/VIq3S
This are the extensions i use.
https://imgur.com/08gmlkC
Here is the dig output.
I do not use anykind of proxy or vpn.

When i scanned my system i used MalwareBytes for mac and Avast antivirus.

[barbaz]

Weird, it doesn't exist...

Does any extension(s) show up in about:support that not show up in the Add-ons Manager?

It shows the most up on youtube and HTTPS is used there.

First thing to try is disable those youtube-related extensions. If that does not work please follow this procedure to see if it's caused by an extension:

Please create a clean profile from scratch. Install only NoScript, leaving all the defaults.
Does the problem still exist?

Try adding back your extensions, one at a time, until you find the one that causes the issue.
Then remove all the others, pairing only the suspected one with NoScript, to confirm that the remaining one is the issue.
If the problem is solved even with all add-ons reinstalled, then the previous profile was probably corrupt. Problem solved.

Let us know, thanks.

[barbaz]

One more thing. When it shows up on pages other than YouTube, do those pages all have embedded YouTube videos?

[Niklas]

Weird, it doesn't exist...

Does any extension(s) show up in about:support that not show up in the Add-ons Manager?

It shows the most up on youtube and HTTPS is used there.

First thing to try is disable those youtube-related extensions. If that does not work please follow this procedure to see if it's caused by an extension:

Please create a clean profile from scratch. Install only NoScript, leaving all the defaults.
Does the problem still exist?

Try adding back your extensions, one at a time, until you find the one that causes the issue.
Then remove all the others, pairing only the suspected one with NoScript, to confirm that the remaining one is the issue.
If the problem is solved even with all add-ons reinstalled, then the previous profile was probably corrupt. Problem solved.

Let us know, thanks.

Thanks for your help, i think just resetting firefox worked. I had a lot of shit in the browser like undeletable (disconnect add on, not activated) extensions, but i got everything removed. I think you may have bin right about it just being youtube, but i am not sure.

[barbaz]

You're welcome