Getting malware through JavaScript and an img tag

Question

I was browsing a website which caused Avast to create a notification that it protected me from an infection. Over the next half hour, this notification popped up again a few times.

The Avast message I get is:

URL:    http://b.scorecardresearch.com/b?c1
Process:    C:\Users\?\AppData\Local\Google\Chrom...
Infection:  URL:Mal

Viewing the source code of the offending site, I've found the offending JavaScript:

<script>
document.write(unescape("%3Cscript src='" + (document.location.protocol == "https:" ? "https://sb" : "http://b") + ".scorecardresearch.com/beacon.js' %3E%3C/script%3E"));
</script>

<noscript>
  <img src="http://b.scorecardresearch.com/p?c1=2&c2=8027488&c3=&c4=&c5=&c6=&c15=&cj=1" />
</noscript>

My question is how does downloading an image lead to an infection? What are the effects of this and how can I remove it from my computer? I just ran an Avast scan that found nothing and am unsure how to proceed from here.

Edit: I cleared my cache as suggested but that did not solve the problem? I just received another Avast notification that it blocked it. I have ran an Avast scan and a Malwarebytes scan which found nothing. My computer has been restarted between attempts also. :/

Answer 1

Malware isn't necessarily about infecting your computer. Many kinds of malware just gather information.

The script loaded by the <script> tag sends information about your browser (e.g., your cookie and your referrer) and the website you're visiting (e.g., its URL and its title) to the offending domain.

The <img> tag inside the <noscript> is supposed to serve the same purpose, gathering that information on from the server and sending it as values to c1, c2, etc. Since most of the fields are blank, the hacker script kiddie doesn't seem to have done a very good job...

Finally, http://b.scorecardresearch.com/p is not an image; it's a script on the attacker's server that stores the information that has been passed to it.

Answer 2

It's not the image download that is the issue it is the JS execution which can lead to a cross-site scripting (XSS) attack. See the XSS Filter Evasion Cheat Sheet and specifically the img src sections to see examples of how this could work.

Unfortunately there are lots of ways that your browser can be 'tricked' into running JS and provide attack vectors.

Answer 3

Here's some information about ScorecardResearch.