Malicious Coding Help Please

[Zerocool37]

Hi everybody,

I think I have some Malicious coding running on my browser or via my browser I have no idea.

No Virusscanner, antimalware tool, reinstall is helping.

It looks like that before a webpages is loaded some kind of framework is put in place that alters every link, button etc.
I just don't have the experience to read where it is exactly coming from, I know it activates allot of JS scripts and on every browser I install I have some type of coding.

It seems like the .dll file on my windows system for browsers or something has been changed.

So I don't know if somebody wants to take a look? I have created some files but I do not know for sure if this is what you need.

If it is helpful to download some tool to generate a report that is useful please let me know.

Many thanks.

 

[FResher]

at less :
- reset your browser ( all browsers / settings / reset )

for a better computer :
- refresh your Os ( with your files to keep )

 

[Infinityhost]

Maybe try to play with it.
At first remove every ---- "..click();" - ending lines.
Then change all z-index: -1; to z-index:100; to see everything clear.
Can You remove these things? ---- crossorigin="anonymous"
Maybe run it in iframe.
Some other things -
"content-visibility: hidden;"
I'm not a pro but maybe it would tell You what's going on.

I run this html.txt file here http://infinityhost.ct8.pl/ (JS compiler button) and it looks like this

 

[Zerocool37]

Hi thanks for the replies.

To be honest I don't have any idea where I need to change that or rather say save it permanently.

I have ran a scan on the .har file and this is the result.
http://www.hybrid-analysis.com/sample/3d2e72ac1dee8ec80ded506c13956043cab67e36330be34552e349232c8fa0a0/64b5bd9ab0397d36b303b796

The image you got is basically the content of my mailbox, is this normal?

 

[c1lonewolf]

You must be using an MS framework or building tool! The following is located in two of the files along with the resource links.
"
THIRD-PARTY SOFTWARE NOTICES
This file is based on or incorporates material from the projects listed below (Third Party Code). The original copyright notice and the license under which Microsoft received such Third Party Code, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party Code to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.

You may find a copy of the Corresponding Source code, if and as required under the Third Party Code License, either bundled with the Microsoft product or at http://3rdpartysource.microsoft.com. If not bundled with the product, you may also obtain a copy of the source code for a period of one year after our last shipment of this product."

also, a lot of the stuff in the third party stuff is "charset=utf-8;base64" encoded. These scripts also use ChatGPT. I've heard only terrible things about it.

 

[FResher]

check the --> drivers <-- of your graphics card ...