18

I was developing my site when a strange banner appeared. First I thought it was my fault, then that it was the webhost provider fault and now I have no idea of where this comes from.

I know it looks ugly and affects all pages I visit. Look how the footer of StackOverflow looks:

stackoverflow with chrome? bug The code itself does not appear in the 'View page source', but it appears when I look at it from the 'Inspect element' and looking at the rendered html. There are more div but some of them are empty. There is a lot of foreign code here. Here is the main one:

<div id="op_ad">
<br>
  <center>
    <iframe src="http://www.games-free-apps.com/games/b.html" style="border:none;width:310px;height:255px;overflow:hidden;" frameborder="0" marginheight="0" marginwidth="0">
    <!-- MORE CODE HERE -->
    </iframe>
  </center>
</div>

And a more detailed screenshot of intrusive code, this time from my website: code detail

So, is this a bug of Chrome, something I broke somehow (I never saw these pieces of code) or malware? Any idea of how can I fix it?

I am using Google Chrome Version 21.0.1180.89 in Ubuntu (native from official page).

EDIT: I started a wiki answer. Please add your hacked extension to the list. I'm going to send an email to Google to see to inform them, but I think they might already be aware.

9
  • 2
    Looks like an annoying advert, have a look at chrome://extensions/ and see if there's anything weird.
    – Rob W
    Sep 24, 2012 at 20:32
  • Can you post a link to more info about anannoyingadvert please? I cannot find it googling. Everything looks fine there, the only possibility is that one of the extensions I use got hacked. Going to do some testing, brb.
    – Frank Presencia Fandos
    Sep 24, 2012 at 20:36
  • 2
    Sorry, I missed my space bar. I've edited my comment to show my intended comment. Open a terminal, and run cd ~/.config/google-chrome/. Then, run grep -rie games-free-apps command to locate the file containing the code.
    – Rob W
    Sep 24, 2012 at 20:39
  • 2
    Yes, it was an extension that was hacked (or maybe original publisher changed it to annoy everyone). Name: "Incognito Switcher 0.6", but suspiciously, the "Visit webpage" link of that extension is throwing an error.
    – Frank Presencia Fandos
    Sep 24, 2012 at 20:39
  • 1
    How did this question get so much attention - especially from new users in the past twelve hours? Did you share the question on social media, or is this issue too common?
    – Rob W
    Sep 25, 2012 at 8:39

5 Answers 5

14

I just had the same thing - the extension which was broken for me was one called Join Tabs... Dodgy!

4
  • 2
    I deleted this and the problem was gone immediately. I've had this extension for a very long time, and have never had a problem with it before... Huh. Sep 25, 2012 at 0:15
  • 1
    Same situation -- have used the extension for months at least and then this. Sep 25, 2012 at 0:42
  • I'm trying this out as a replacement chrome.google.com/webstore/detail/…, it looks good
    – Andrija
    Sep 25, 2012 at 14:18
  • Same here. How does one flag an extension as malicious?
    – andybak
    Sep 25, 2012 at 14:38
11

I had the same problem and it turned out to be the extension "Web RSS Subscriber" that was to blame.

2
  • "Web RSS Subscriber 1.3" for me too
    – Helpa
    Sep 25, 2012 at 11:21
  • +1. There appears to be a replacement authored by Google, search for "RSS Subscription Extension (by Google)".
    – Kos
    Sep 26, 2012 at 6:41
8

Apparently some extensions in Google Chrome, includying old and obsolete ones, have been hacked. If you are having the problem stated in the OP, please follow these steps and add the extension that causes the trouble to the list.

Known extensions that have been hacked:

  • Inkognito Tab Switch 2.2

  • Incognito Switcher

  • Join Tabs

  • Web RSS Subscriber

Steps to find out the rotten extensions:

  • Disable all your extensions. Options->Settings->Extensions

  • Enable the first one. Open a webpage where you have had the same problem, and check if it happens now.

  • If it happens, add that extension to the list. If it doesn't happen, disable that extension and repeat for the next extension.

2

I had the same problem with JoinTabs. At first I thought it was just an ad on the page until it started appearing on every webpage. I would suggest JoinTabs (no icon). It serves the same purpose but doesn't have the stupid ad appended to every page:

Link

You will need to drag and drop it into the extension window though since this is outside the Chrome Web Store.

0

I tracked down that Diigo Web Collector 2.26 had been hacked and html was being inserted into my documents, causing the site not to work. Added ID to body of dummybodyID and inserted divs with weird classes and display:none that apparently loaded 1276 x 0 images.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .