Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I really wasn't sure where to ask this, here, gaming, stack overflow, it can fit into any of them but I'll post it here. Sorry if I'm posting in the wrong area.

I was playing Half-Life just now and went to look up what a certain console cvar did via Steam's in-game browser. I clicked on a relevant result and after reading for a couple seconds millions of voices started pouring through my headphones. I couldn't understand what any of them were saying but that's irrelevant.

This happened out of nowhere after doing nothing more than clicking the first result for a Google search in Steam's in-game browser. It scared me senseless, I threw off my headphones, immediately killed the game and shut down my computer.

I booted back up with no problems and ran a quick scan via Malwarebytes and it found nothing. When I visit this page on my Firefox (AdBlock Plus + NoScript) setup it's perfectly safe and I even had a friend visit the page with internet explorer and nothing happened to him other than a browser crash.

This is my first build. I spent a lot of money on it. I cherish it infinitely and spend a great deal of my life using it. I'm pretty shook up and I'm not sure what to think about this or what sort of action to take and that's what leads me here. I'm not a serious programmer but I am familiar with programming. All I want to know is what the hell that was, what I should do, and what I should not do. Thank you in advance.

PS: I'm thinking it was some sort of javascript exploit because, as I said, I run NoScript AND AdBlock Plus on my Firefox installation and I can visit the page like it's any other. I will link to the page and also give the source if it will help. The best way I can describe it is what you hear when you type "soundchaosdebug" into chat in Diablo II.

WARNING, POTENTIALLY UNSAFE LINK! DO NOT CLICK WITHOUT PROPER PROTECTION!

http:[unsafe]//www.opensubscriber.com/message/hlds@list.valvesoftware.com/5016556.html

WARNING, POTENTIALLY UNSAFE LINK! DO NOT CLICK WITHOUT PROPER PROTECTION!

share|improve this question
1  
The page does not seem to have any malicious scripts (only jQuery, ads, and generic drop-down menus), embedded objects, or Java applets. –  grawity Feb 2 '11 at 21:22
1  
Very interesting, if no script was functioning properly no java script should have run. Unless of course there was an exploit in No script. –  Kyle Feb 2 '11 at 21:24
2  
Do you regularly back up your system? –  Kyle Feb 2 '11 at 21:26
1  
Ouch, Run a full scan of Mbam and microsoft security essentials in safe mode. I'm a big fan of the, "when in doubt nuke it out of orbit" mindset, but without backups that probably isn't the best option on a system that "may" be infected. –  Kyle Feb 2 '11 at 21:35
1  
O yeah one more thing: start backing up! ;) It makes recovering from such an incident nearly painless. –  Kyle Feb 2 '11 at 22:04

3 Answers 3

Opensubscriber.com itself seems to be safe; the problems lie in the sites it links to:

<script type="text/javascript" src="http://ads.clicksor.com/showAd.php?nid=1&pid=150886&adtype=1&sid=226316"></script>

Clicksor has been reviewed as having viruses by both WOT and McAfee SiteAdvisor reviewers.

<noscript><a href="http://www.yesadvertising.com">affiliate marketing</a></noscript>

Yesadvertising has also been reviewed as having viruses by both WOT and McAfee SiteAdvisor reviewers.

share|improve this answer

You might want to just reformat, this may be a pain without backups but after reading what horatio said I would definitely Nuke my install. I also noticed that the first two times I tried loading the site our Palo Alto PA2020 blocked it. I didn't think much of it since this firewall is pretty hardcore and sometimes a little overzealous, and nothing looked out of place after I got on there. But with a service like Clicksor you can't know for sure what the ad company may have injected in their banners. Sorry if this isn't the answer you are looking for but it is the only way to know you for sure that your PC is clean.

EDIT: Read this.

Con

  • Possibility of displaying irrelevant ads[9]

  • Accept English sites only

  • Slow loading time of ads

  • Serving ads containing Malware and Trojans

share|improve this answer
1  
You can but there is always a chance that something was missed. –  Kyle Feb 2 '11 at 21:42
1  
It's entirely possible that you weren't infected, Personally I would assume I was infected if this same thing happened to me. The point NEEDS to be made that you cannot know for sure without a reformat. You could always just wait and see if anything odd starts happening or if anything is trying to open unknown connections to or from your computer. –  Kyle Feb 2 '11 at 21:52
1  
How would I go about observing that? –  I take Drukqs Feb 2 '11 at 21:56
1  
I would start with wireshark, but you should probably open a new question if you need specific instructions. –  Kyle Feb 2 '11 at 21:57
1  
Understood. Thanks so much for your helpful and quick replies. –  I take Drukqs Feb 2 '11 at 21:59

The site uses clicksor as an ad site, there are reports that clicksor does not properly vet their advertisers and there are people claiming that some ads served up by clicksor contain viruses and malware. Ads rotate, so it might take multiple reloads of the site to re-encounter the particular ad you were served.

I think the short answer is: don't ever use steam's web browser.

share|improve this answer
    
Malwarebytes didn't find anything though. Can you give me more insight as to what it does and what I should do? I want whatever happened purged from my system entirely. Also I agree. If I need to use a web browser from now on for anything I'm alt+tabbing. –  I take Drukqs Feb 2 '11 at 21:36
1  
I can't because there is no specific malware mentioned. Just that the clicksor site inserts ads into the page, and the ad itself (created by someone other than clicksor) might contain some form of malware. Note that "quick scan" usually does not scan the steam folder. –  horatio Feb 2 '11 at 21:42
1  
I can't find info, but it is /plausible/ that the browser is hosted by the steam service which might explain why it was still running after you exited the game... –  horatio Feb 2 '11 at 21:44
    
You're right. I didn't kill Steam. Just the game that runs under Steam. My scan results are back and everything is clean except for one file which is a false positive. –  I take Drukqs Feb 2 '11 at 21:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.