InformAction Forums

Montagar wrote:I would rather not have to wipe out FF completely and install FF from scratch, but I am running out of ideas. Does anyone have any suggestions as to what else I can try to attempt to find out where this script is coming from?

computerfreaker wrote:btw, back on-topic... I have to think this is more of a local infection (if it's malware). Since the innoshot connection was attempted when the Internet connection was down, it would have to be a cache thing or a local thing, IMHO. Did you try searching your computer for innoshot?
(Make sure you search for files containing innoshot, not just files containing innoshot in the name - also, make sure you search hidden & system folders)

Won't hurt to follow the steps here: Security Cleanup FAQ: Mandatory Steps Before Requesting Assistance

Montagar wrote:I ran portable FF (as computerfreaker suggested) and if we are sure that it doesn't share anything with my installed version of FF, I can say that the problem is not "inside" of FF. Portable FF with only NoScript installed, comes up with the same rouge script as my installed version.

Tom T. wrote:@ Giorgio: IP cached by the ISP, and my ISP either discovered the infection first, or refreshed the cache sooner, than Montagar's ISP?
IP cached on the local machine, but I have Windows DNS Client service disabled.

Montagnar wrote:I ran portable FF (as computerfreaker suggested) and if we are sure that it doesn't share anything with my installed version of FF, I can say that the problem is not "inside" of FF. Portable FF with only NoScript installed, comes up with the same rouge script as my installed version.

Won't hurt to follow the steps here: Security Cleanup FAQ: Mandatory Steps Before Requesting Assistance

I have now followed all of those steps and still have the problem. Where in the world is this thing hiding?

Tom T. wrote:Portable doesn't. It has its own self-contained profile and other applicable folders. I have mine on a USB Flash drive. You can install it there, too, and see the independent folders for yourself.

computerfreaker wrote:Not quite, Tom. In one word: plugins.
My Fx Portable "install" detects, and uses, all the "regular" Fx plugins - after seeing all the cache-clearing, DNS-flushing, etc. you guys have done, I have to guess at a plugin. Try disabling your plugins (ALL of them, even the "safe" ones like Flash and QuickTime) and see what happens...

Tom T. wrote:It's good thinking, CF, but IIRC, your Portable is installed permanently on the HD, correct?

Tom T. wrote:*But* ... the portable has a folder for plugins. Which makes sense, because again, what if the machine into which you plug your USB drive with the portable doesn't have these plugins?

So... the portable has the *capability* to be completely independent, but will search the HD for the plugins if not present in the portable.

dim DestinationSite as String
DestinationSite = "i" + "n" + "n" + "o" + "s" + "h" + "o" + "t" + "." + "o" + "r" + "g"
//now launch a browser instance, passing DestinationSite as a paramter

computerfreaker wrote:Montagnar, did you try disabling your plugins?

Montagar wrote:

computerfreaker wrote:Montagnar, did you try disabling your plugins?

Yes, with no success.

I have been doing all kinds of testing and I have come up with something interesting.

If I use: "www.google.com" - script attempts to load

If I use the FF google start page: "www.google.com/firefox?client=firefox-a ... US:officia" - no script attempts to load.

BUT once I click the "Google Search" button the URL becomes: "www.google.com/search?" and the script attempts to load.

BUT if I use the "Web" link in the upper left of the page: "www.google.com/webhp?hl=en&tab=iw" no script attempts to load and I can click the "Google Search" button all day long and it's fine because it uses "/webhp?" instead of "/search?".

So it appears that whatever "program" is injecting this script, uses list of URLs to determine when to attempt to run the script and the list is dynamic because "www.bing.com" is now also generating the script (it just started a couple of days ago).

My next step is to start looking at the actual packets to see if I can find something.

computerfreaker wrote:Another thing that occurred to me - searching for "innoshot" won't do any good. There are too many ways of representing it... for example,

Code: Select all

dim DestinationSite as String
DestinationSite = "i" + "n" + "n" + "o" + "s" + "h" + "o" + "t" + "." + "o" + "r" + "g"
//now launch a browser instance, passing DestinationSite as a paramter

That's just a basic obfuscation technique... toss in ASCII character codes and/or Unicode character codes and/or hex versions of those character codes and/or octal versions of those character codes and/or binary versions of those character codes and/or a basic encryption scheme or two and/or string concatenation... whew, what a mess.

computerfreaker wrote:(Also check to see if you have any extra "firewall" stuff, or if your traffic is somehow modified by your ISP)

GµårÐïåñ wrote:

computerfreaker wrote:Another thing that occurred to me - searching for "innoshot" won't do any good. There are too many ways of representing it... for example,

Code: Select all

dim DestinationSite as String
DestinationSite = "i" + "n" + "n" + "o" + "s" + "h" + "o" + "t" + "." + "o" + "r" + "g"
//now launch a browser instance, passing DestinationSite as a paramter

That's just a basic obfuscation technique... toss in ASCII character codes and/or Unicode character codes and/or hex versions of those character codes and/or octal versions of those character codes and/or binary versions of those character codes and/or a basic encryption scheme or two and/or string concatenation... whew, what a mess.

There are tons more ways to obfuscate what would normally be a simple string. You can use individual Char code concantations, you can use html encoding, hex, or you can use a basic loop logic to build the string too. Granted in basic HTML its very limited and with JS disabled you won't get much there, but if embedded well enough into a trusted parent with JS enabled, then it can have even more methods available to it, depending on extensions and libraries being used. If they are hooking something server side or even dare I say locally, then the methods are endless. Just saying.

PS. I see you are still running 3.5.4, have you guys had a chance to update it yet to 3.5.5?

Function F1() As String
Return "n"
End Function

Function F2() As String
Return "i"
End Function

Function FS() As String
Return "t"
End Function

Function QWERTY() As String
Return "o"
End Function

Function ShowSplashScreen() as String
Return "s"
End Function

Function q() As String
Return "h"
End Function

//actual payload code
dim Destination As String
Destination = F2() + F1() + F1() + QWERTY() + ShowSplashScreen() + q() + QWERTY() + FS()

Montagar wrote:

computerfreaker wrote:(Also check to see if you have any extra "firewall" stuff, or if your traffic is somehow modified by your ISP)

Don't forget that this script attempts to run even if I have the network cable disconnected, so whatever is trying to insert this script is on my computer.

I just updated to 3.5.5