1

I think I am infected with a Static.Hotjar.com Malware, I noticed whenever I open the Gamivo website (which sells Steam game keys), on the bottom left corner of Google Chrome it says "Waiting for Static.Hotjar.com" and then tries uploading a file. (Uploading ... 10%) etc.

I haven't noticed this happening on any other website.

I want to know what file it's trying to upload.

There has to be a way to see what file is being uploaded with Chrome's DevTools (F12).


This is the link to Gamivo's website: https://www.gamivo.com

I also installed a nice extension called "ScriptSafe" which actually after installing it protected me from the Malware, and the "uploading ... 15%" messages didn't show up anymore.

I don't know how I got infected, All I remember is I installed two or three extensions for chrome recently, not going to list them because I don't want to undermine their developers, I need to make sure what extension actually caused this.

I can see this happening every time I refresh the Gamivo's webpage.

UPDATE: I don't think I'm infected, I tried opening the website on Chrome on a Win 10 VM and the same thing happened again, it tries to upload something (didn't see the hotjar message though).

migrated from security.stackexchange.com Jan 31 at 16:28

This question came from our site for information security professionals.

  • 1
    While you are concerned about security, your actual question is not a security question but a Chrome question (that would be applicable even if there wasn't an infection). – schroeder Jan 31 at 16:27
  • @schroeder You're right, I was confused where to ask this. Sorry for the problem. – Shayan Jan 31 at 16:29
  • 1
    No problem, that's why we have a "migrate" button :) – schroeder Jan 31 at 16:30
1

The website hotjar.com seems to be a legit website, marketing software that tells web-masters exactly what the user is doing on their website, to the millisecond. This software is included as JavaScript in the website that uses it, to trace the user's activity.

The extension ScriptSafe prevents JavaScript from executing, which probably disabled those JavaScript scripts that are coming from hotjar.com.

From the fact that you found no file-name for the uploaded data, I would guess that the hotjar JavaScript is trying to upload memory-accumulated data (or file) about your activity.

In my opinion you are not infected in the strict sense, but you do have unwanted software using your browser for its own purposes, which is certainly not very nice or acceptable.

You should check to see that the website responsible for this behavior has not crossed some red lines:

  • Check your homepage and startup page for unwanted changes.
  • Check your extensions in chrome://extensions/ to ensure they are all needed.
  • If you still suspect unwanted settings in Chrome, uninstall it, clean up all its folders, then re-install, thus restarting from scratch.

If you find nothing, you may keep on using ScriptSafe to neutralize such websites. Well-known alternatives are UBlock and UMatrix.

0

After googling about "how to see what file i'm uploading with devtools", I stumbled upon this link:

https://community.box.com/t5/Managing-Content-Troubleshooting/How-to-Generate-a-HAR-File-in-Chrome-IE-Firefox-and-Safari/ta-p/366


Open DevTools and on the Network page wait for the Uploading (25%)... message to pop up on the bottom left corner of Chrome.

It doesn't work if you stop the upload half-way through by stopping the page, or going to another webpage, you have to let the upload finish.

You will know which row in Network panel is for uploading by looking at Status, it should be (Pending) even if it doesn't you can find it because it will be the last row.

Right-click on the row and click "Save as HAR with content" now open up Notepad++ and search for filename=\" and you will know what it was trying to upload.

I tested this on a uploading website and it worked.

On the Gamivo's case, I don't know if it's an actual file but here's what I found:

fileName=\"\",e.prototype.functionName=\"\"

fileName=\"\",r.functionName=\"\"

I don't understand it

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.