Is this code supposed to be injected into every single page I browse on Chrome?

Question

A week ago I noticed the following CSS/Javascript being injected into all pages I browse. Supposedly its from Avast, but I don't have a plugin from Avast. There is no information available anywhere about this code, its purpose and Avast is not answering. I did multiple virus scans with lots of different software and re-installed everything and no virus was found, but this weird injection did not go away either.

If page code is viewed normally, this code is not visible. It can be seen with firebug lite on chrome or if the page is saved as html. It is always attached right before the close of the head tag. All else seems to work fine. The chrome links show a small avast logo, others are broken.

<style id="wrc-middle-css" type="text/css">.wrc_whole_window{   display: none;  position: fixed;    z-index: 2147483647;    background-color: rgba(40, 40, 40, 0.9);    word-spacing: normal;   margin: 0px;    padding: 0px;   border: 0px;    left: 0px;  top: 0px;   width: 100%;    height: 100%;   line-height: normal;    letter-spacing: normal;}.wrc_middle_main {  font-family: Segoe UI, Arial Unicode MS, Arial, Sans-Serif; font-size: 14px;    width: 600px;   height: auto;   margin: 0px auto;   margin-top: 15%;    background: url(chrome-extension://icmlaeflemplmjndnaapfdbbnpncnbda/skin/images/background-body.jpg) repeat-x left top; background-color: rgb(39, 53, 62);}.wrc_middle_logo {    background: url(chrome-extension://icmlaeflemplmjndnaapfdbbnpncnbda/skin/images/logo.jpg) no-repeat left bottom;    width: 140px;    height: 42px;    color: orange;    display: table-cell;    text-align: right;    vertical-align: middle;}.wrc_icon_warning {  margin: 20px 10px 20px 15px;    float: left;    background-color: transparent;}.wrc_middle_title {    color: #b6bec7;   height: auto;    margin: 0px auto;  font-size: 2.2em;   white-space: nowrap;    text-align: center;}.wrc_middle_hline {    height: 2px; width: 100%;    display: block;}.wrc_middle_description {   text-align: center; margin: 15px;   font-size: 1.4em;   padding: 20px;  height: auto;   color: white;   min-height: 3.5em;}.wrc_middle_actions_main_div {   margin-bottom: 15px;    text-align: center;}.wrc_middle_actions_blue_button {   -moz-appearance: none;  border-radius: 7px; -moz-border-radius: 7px/7px;    border-radius: 7px/7px; background-color: rgb(0, 173, 223) !important;  display: inline-block;  width: auto;    cursor: Pointer;    border: 2px solid #00dddd;}.wrc_middle_actions_blue_button:hover {  background-color: rgb(0, 159, 212) !important;}.wrc_middle_actions_blue_button:active { background-color: rgb(0, 146, 200) !important;  border: 2px solid #00aaaa;}.wrc_middle_actions_blue_button div {    display: inline-block;  width: auto;    cursor: Pointer;    margin: 3px 10px 3px 10px;  color: white;   font-size: 1.2em;   font-weight: bold;}.wrc_middle_action_low { font-size: 0.9em;   white-space: nowrap;    cursor: Pointer;    color: grey !important; margin: 10px 10px 0px 10px; text-decoration: none;}.wrc_middle_action_low:hover {   color: #aa4400 !important;}.wrc_middle_actions_rest_div {   padding-top: 5px;   white-space: nowrap;    text-align: center;}.wrc_middle_action {    white-space: nowrap;    cursor: Pointer;    color: red !important;  font-size: 1.2em;   margin: 10px 10px 0px 10px; text-decoration: none;}.wrc_middle_action:hover {   color: #aa4400 !important;}</style>

<script id="wrc-script-middle_window" type="text/javascript" language="JavaScript">var g_inputsCnt = 0;var g_InputThis = new Array(null, null, null, null);var g_alerted = false;/* we test the input if it includes 4 digits   (input is a part of 4 inputs for filling the credit-card number)*/function is4DigitsCardNumber(val){    var regExp = new RegExp('[0-9]{4}');    return (val.length == 4 && val.search(regExp) == 0);}/* testing the whole credit-card number 19 digits devided by three '-' symbols or   exactly 16 digits without any dividers*/function isCreditCardNumber(val){  if(val.length == 19)    {       var regExp = new RegExp('[0-9]{4}-[0-9]{4}-[0-9]{4}-[0-9]{4}');     return (val.search(regExp) == 0);   }   else if(val.length == 16)   {       var regExp = new RegExp('[0-9]{4}[0-9]{4}[0-9]{4}[0-9]{4}');        return (val.search(regExp) == 0);   }   return false;}function CheckInputOnCreditNumber(self){  if(g_alerted)       return false;   var value = self.value; if(self.type == 'text') {       if(is4DigitsCardNumber(value))      {           var cont = true;            for(i = 0; i < g_inputsCnt; i++)                if(g_InputThis[i] == self)                  cont = false;           if(cont && g_inputsCnt < 4)         {               g_InputThis[g_inputsCnt] = self;                g_inputsCnt++;          }       }       g_alerted = (g_inputsCnt == 4);     if(g_alerted)           g_inputsCnt = 0;        else            g_alerted = isCreditCardNumber(value);  }   return g_alerted;}function CheckInputOnPassword(self){  if(g_alerted)       return false;   var value = self.value; if(self.type == 'password') {       g_alerted = (value.length > 0); }   return g_alerted;}function onInputBlur(self, bRatingOk, bFishingSite){  var bCreditNumber = CheckInputOnCreditNumber(self); var bPassword = CheckInputOnPassword(self); if((!bRatingOk || bFishingSite == 1) && (bCreditNumber || bPassword) )  {       var warnDiv = document.getElementById("wrcinputdiv");       if(warnDiv)     {           /* show the warning div in the middle of the screen */          warnDiv.style.left = "0px";         warnDiv.style.top = "0px";          warnDiv.style.width = "100%";           warnDiv.style.height = "100%";          document.getElementById("wrc_warn_fs").style.display = 'none';          document.getElementById("wrc_warn_cn").style.display = 'none';          if(bFishingSite)                document.getElementById("wrc_warn_fs").style.display = 'block';         else                document.getElementById("wrc_warn_cn").style.display = 'block';         warnDiv.style.display = 'block';        }   }}</script></head>
    <body>

The comments in the javascript and function names obviously concern me.

Is this avast? Phishing checker? Any ideas?

Answer 1

Looking through the second long line of javascript there, it's not trying very hard to disguise what its purpose is, thankfully: it is commented and isn't obfuscated in any way, which tells us that whoever wrote doesn't mind us knowing what it does.

I believe that this script is from Avast Internet Security and is actually there to prompt you with a warning if it looks like you're sending a credit card or submitting a password; it might do it all the time; or only when it believes the site is a phishing site, I'm not sure.

It's either injecting it via a browser extension, or doing it through a local http proxy so that it works in any browser on the machine (can't tell you that - I don't have it installed).

So I don't think it's a cause for any concern.

Answer 2

doing it through a local http proxy

That was my first thought, that Avast has a firewall or something that adds a filter driver to the network cards and intercepts pages, injecting it.

However, the code is clearly from a Chrome extension with the id icmlaeflemplmjndnaapfdbbnpncnbda. This corresponds to the Chrome extension Avast! WebRep which gives websites a community-assigned reputation like Web of Trust or McAfee’s SiteAdvisor. It’s gone now, but you almost definitely have it installed.

You aren’t the only one who doesn’t like it; the top search results for it are about You can disable (or remove) it from the extensions page:

chrome://extensions