Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A week ago I noticed the following CSS/Javascript being injected into all pages I browse. Supposedly its from Avast, but I don't have a plugin from Avast. There is no information available anywhere about this code, its purpose and Avast is not answering. I did multiple virus scans with lots of different software and re-installed everything and no virus was found, but this weird injection did not go away either.

If page code is viewed normally, this code is not visible. It can be seen with firebug lite on chrome or if the page is saved as html. It is always attached right before the close of the head tag. All else seems to work fine. The chrome links show a small avast logo, others are broken.

<style id="wrc-middle-css" type="text/css">.wrc_whole_window{   display: none;  position: fixed;    z-index: 2147483647;    background-color: rgba(40, 40, 40, 0.9);    word-spacing: normal;   margin: 0px;    padding: 0px;   border: 0px;    left: 0px;  top: 0px;   width: 100%;    height: 100%;   line-height: normal;    letter-spacing: normal;}.wrc_middle_main {  font-family: Segoe UI, Arial Unicode MS, Arial, Sans-Serif; font-size: 14px;    width: 600px;   height: auto;   margin: 0px auto;   margin-top: 15%;    background: url(chrome-extension://icmlaeflemplmjndnaapfdbbnpncnbda/skin/images/background-body.jpg) repeat-x left top; background-color: rgb(39, 53, 62);}.wrc_middle_logo {    background: url(chrome-extension://icmlaeflemplmjndnaapfdbbnpncnbda/skin/images/logo.jpg) no-repeat left bottom;    width: 140px;    height: 42px;    color: orange;    display: table-cell;    text-align: right;    vertical-align: middle;}.wrc_icon_warning {  margin: 20px 10px 20px 15px;    float: left;    background-color: transparent;}.wrc_middle_title {    color: #b6bec7;   height: auto;    margin: 0px auto;  font-size: 2.2em;   white-space: nowrap;    text-align: center;}.wrc_middle_hline {    height: 2px; width: 100%;    display: block;}.wrc_middle_description {   text-align: center; margin: 15px;   font-size: 1.4em;   padding: 20px;  height: auto;   color: white;   min-height: 3.5em;}.wrc_middle_actions_main_div {   margin-bottom: 15px;    text-align: center;}.wrc_middle_actions_blue_button {   -moz-appearance: none;  border-radius: 7px; -moz-border-radius: 7px/7px;    border-radius: 7px/7px; background-color: rgb(0, 173, 223) !important;  display: inline-block;  width: auto;    cursor: Pointer;    border: 2px solid #00dddd;}.wrc_middle_actions_blue_button:hover {  background-color: rgb(0, 159, 212) !important;}.wrc_middle_actions_blue_button:active { background-color: rgb(0, 146, 200) !important;  border: 2px solid #00aaaa;}.wrc_middle_actions_blue_button div {    display: inline-block;  width: auto;    cursor: Pointer;    margin: 3px 10px 3px 10px;  color: white;   font-size: 1.2em;   font-weight: bold;}.wrc_middle_action_low { font-size: 0.9em;   white-space: nowrap;    cursor: Pointer;    color: grey !important; margin: 10px 10px 0px 10px; text-decoration: none;}.wrc_middle_action_low:hover {   color: #aa4400 !important;}.wrc_middle_actions_rest_div {   padding-top: 5px;   white-space: nowrap;    text-align: center;}.wrc_middle_action {    white-space: nowrap;    cursor: Pointer;    color: red !important;  font-size: 1.2em;   margin: 10px 10px 0px 10px; text-decoration: none;}.wrc_middle_action:hover {   color: #aa4400 !important;}</style>

<script id="wrc-script-middle_window" type="text/javascript" language="JavaScript">var g_inputsCnt = 0;var g_InputThis = new Array(null, null, null, null);var g_alerted = false;/* we test the input if it includes 4 digits   (input is a part of 4 inputs for filling the credit-card number)*/function is4DigitsCardNumber(val){    var regExp = new RegExp('[0-9]{4}');    return (val.length == 4 && val.search(regExp) == 0);}/* testing the whole credit-card number 19 digits devided by three '-' symbols or   exactly 16 digits without any dividers*/function isCreditCardNumber(val){  if(val.length == 19)    {       var regExp = new RegExp('[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{4}');     return (val.search(regExp) == 0);   }   else if(val.length == 16)   {       var regExp = new RegExp('[0-9]{4}[0-9]{4}[0-9]{4}[0-9]{4}');        return (val.search(regExp) == 0);   }   return false;}function CheckInputOnCreditNumber(self){  if(g_alerted)       return false;   var value = self.value; if(self.type == 'text') {       if(is4DigitsCardNumber(value))      {           var cont = true;            for(i = 0; i < g_inputsCnt; i++)                if(g_InputThis[i] == self)                  cont = false;           if(cont && g_inputsCnt < 4)         {               g_InputThis[g_inputsCnt] = self;                g_inputsCnt++;          }       }       g_alerted = (g_inputsCnt == 4);     if(g_alerted)           g_inputsCnt = 0;        else            g_alerted = isCreditCardNumber(value);  }   return g_alerted;}function CheckInputOnPassword(self){  if(g_alerted)       return false;   var value = self.value; if(self.type == 'password') {       g_alerted = (value.length > 0); }   return g_alerted;}function onInputBlur(self, bRatingOk, bFishingSite){  var bCreditNumber = CheckInputOnCreditNumber(self); var bPassword = CheckInputOnPassword(self); if((!bRatingOk || bFishingSite == 1) && (bCreditNumber || bPassword) )  {       var warnDiv = document.getElementById("wrcinputdiv");       if(warnDiv)     {           /* show the warning div in the middle of the screen */          warnDiv.style.left = "0px";         warnDiv.style.top = "0px";          warnDiv.style.width = "100%";           warnDiv.style.height = "100%";          document.getElementById("wrc_warn_fs").style.display = 'none';          document.getElementById("wrc_warn_cn").style.display = 'none';          if(bFishingSite)                document.getElementById("wrc_warn_fs").style.display = 'block';         else                document.getElementById("wrc_warn_cn").style.display = 'block';         warnDiv.style.display = 'block';        }   }}</script></head>
    <body>

The comments in the javascript and function names obviously concern me.

Is this avast? Phishing checker? Any ideas?

share|improve this question

migrated from stackoverflow.com Mar 3 '12 at 3:39

This question came from our site for professional and enthusiast programmers.

1  
from the CSS it looks like it might be a Chrome extension you have. –  Graham Clark Mar 2 '12 at 16:16
    
I wouldn't like the look of that either. Do you see it if you are in incognito mode? Could it be an extension you have installed? –  MrMisterMan Mar 2 '12 at 16:18
    
I've voted to close - off-topic. But given that Chrome shows an 'avast' icon my guess it's something to do with avast internet security –  Andras Zoltan Mar 2 '12 at 16:19
    
i installed firebug lite. yet errors about avist. i dont want to break rules with my off topic. but i thank you all for your answers. –  user1245478 Mar 2 '12 at 16:37
add comment

2 Answers

up vote 2 down vote accepted

Looking through the second long line of javascript there, it's not trying very hard to disguise what its purpose is, thankfully: it is commented and isn't obfuscated in any way, which tells us that whoever wrote doesn't mind us knowing what it does.

I believe that this script is from Avast Internet Security and is actually there to prompt you with a warning if it looks like you're sending a credit card or submitting a password; it might do it all the time; or only when it believes the site is a phishing site, I'm not sure.

It's either injecting it via a browser extension, or doing it through a local http proxy so that it works in any browser on the machine (can't tell you that - I don't have it installed).

So I don't think it's a cause for any concern.

share|improve this answer
    
thanks. appreciate it. –  user1245478 Mar 2 '12 at 16:32
add comment

doing it through a local http proxy

That was my first thought, that Avast has a firewall or something that adds a filter driver to the network cards and intercepts pages, injecting it.

However, the code is clearly from a Chrome extension with the id icmlaeflemplmjndnaapfdbbnpncnbda. This corresponds to the Chrome extension Avast! WebRep which gives websites a community-assigned reputation like Web of Trust or McAfee’s SiteAdvisor. It’s gone now, but you almost definitely have it installed.

You aren’t the only one who doesn’t like it; the top search results for it are about You can disable (or remove) it from the extensions page:

chrome://extensions
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.