: How to trace origin of script injected in my webpage I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script <script
I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script
<script src="https://engowe.com/ad.php?u=e38324c56607a8891ad6496ae98e66a1&c=gpupdater&p=1"></script>
Placed just before the closing of </head> which leads to this code
My attention was drawn to it by the unescaped ampersands, and I had no memory of putting it there. Checking the source code I found no existence of this script.
I have found this script in other pages of mine, but am not sure what it does, or where it comes from, nor how to go about doing so. The only external javascript libraries I am using are JQuery and modernizer, neither of which I would expect to do this.
More alarming, looking at the sources of my sites resources show a sleuth of material I have no knowledge of. This is particularly perplexing on a static site which, is not live, and has no plugins or external media! At the very least it is putting a significant drag on loading the site (particularly due to a lack of response from a "linkr.us" server), but more to the point I am concerned about security vulnerabilities on my other sites.
How do I go about tracing the origin of what I can only assume is malicious code?
More posts by @Jessie594
2 Comments
Sorted by latest first Latest Oldest Best
I was also infected by this. It is some malware that install Privproxy (www.privoxy.org) listening on the TCP port 8118 that injects JavaScript line into every HTML page, and it also set the Windows system proxy setting to localhost:8118. Just disable the proxy setting and uninstall Privproxy.
This is almost certainly injected into pages on your own machine. Various malware, once installed, adds itself to loaded pages in order to affect the functioning of the page (generally by replacing ads with its own ads so the authors can collect the click revenue). See this question for more info.
To test, check the actual server files, or use cURL or a similar tool to directly retrieve the files. If the server files are fine, try from a completely different machine and see if the code is also injected there.
Terms of Use Create Support ticket Your support tickets Stock Market News! © vmapp.org2024 All Rights reserved.