Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was browsing a website which caused Avast to create a notification that it protected me from an infection. Over the next half hour, this notification popped up again a few times.

The Avast message I get is:

URL:    http://b.scorecardresearch.com/b?c1
Process:    C:\Users\?\AppData\Local\Google\Chrom...
Infection:  URL:Mal

Viewing the source code of the offending site, I've found the offending JavaScript:

<script>
document.write(unescape("%3Cscript src='" + (document.location.protocol == "https:" ? "https://sb" : "http://b") + ".scorecardresearch.com/beacon.js' %3E%3C/script%3E"));
</script>

<noscript>
  <img src="http://b.scorecardresearch.com/p?c1=2&c2=8027488&c3=&c4=&c5=&c6=&c15=&cj=1" />
</noscript>

My question is how does downloading an image lead to an infection? What are the effects of this and how can I remove it from my computer? I just ran an Avast scan that found nothing and am unsure how to proceed from here.

Edit: I cleared my cache as suggested but that did not solve the problem? I just received another Avast notification that it blocked it. I have ran an Avast scan and a Malwarebytes scan which found nothing. My computer has been restarted between attempts also. :/

share|improve this question
1  
Because the being downloaded isn't actually an image? –  Ramhound May 10 '13 at 16:03

3 Answers 3

up vote 2 down vote accepted

Malware isn't necessarily about infecting your computer. Many kinds of malware just gather information.

The script loaded by the <script> tag sends information about your browser (e.g., your cookie and your referrer) and the website you're visiting (e.g., its URL and its title) to the offending domain.

The <img> tag inside the <noscript> is supposed to serve the same purpose, gathering that information on from the server and sending it as values to c1, c2, etc. Since most of the fields are blank, the hacker script kiddie doesn't seem to have done a very good job...

Finally, http://b.scorecardresearch.com/p is not an image; it's a script on the attacker's server that stores the information that has been passed to it.

share|improve this answer
    
Thanks for the response. Can you explain why Avast created notifications after I closed the browser (10+ minutes)? Wouldn't the JavaScript have been terminated? Could there be a lasting effect on my machine or is this a one time event? Thanks! –  AwesomeAuger May 10 '13 at 16:19
    
As an aside: actually, the URL does return an image. But surely the server is recording things before returning it. –  Arjan May 10 '13 at 16:21
    
I have no idea how Avast works internally. It might simply have reacted to the cached website on your hard disk. –  sudo May 10 '13 at 16:26
    
2.5 hours after visiting the page, I got another Avast popup with the same information. Is there anything I can do besides run scans, hoping that one picks it up? –  AwesomeAuger May 10 '13 at 16:26
    
Try clearing the cache (go to chrome://settings/clearBrowserData, check Empty the cache and confirm). –  sudo May 10 '13 at 16:28

It's not the image download that is the issue it is the JS execution which can lead to a cross-site scripting (XSS) attack. See the XSS Filter Evasion Cheat Sheet and specifically the img src sections to see examples of how this could work.

Unfortunately there are lots of ways that your browser can be 'tricked' into running JS and provide attack vectors.

share|improve this answer
    
While true, I don't think it applies to this case? –  Arjan May 10 '13 at 16:23

Here's some information about ScorecardResearch.

share|improve this answer
    
That was one of the results of my searches into this. Another was this.. Is this completely different? –  AwesomeAuger May 10 '13 at 16:35
    
I'm having some difficulty understanding what that's getting at. –  David Marshall May 10 '13 at 16:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.