Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was developing my site when a strange banner appeared. First I thought it was my fault, then that it was the webhost provider fault and now I have no idea of where this comes from.

I know it looks ugly and affects all pages I visit. Look how the footer of StackOverflow looks:

stackoverflow with chrome? bug The code itself does not appear in the 'View page source', but it appears when I look at it from the 'Inspect element' and looking at the rendered html. There are more div but some of them are empty. There is a lot of foreign code here. Here is the main one:

<div id="op_ad">
<br>
  <center>
    <iframe src="http://www.games-free-apps.com/games/b.html" style="border:none;width:310px;height:255px;overflow:hidden;" frameborder="0" marginheight="0" marginwidth="0">
    <!-- MORE CODE HERE -->
    </iframe>
  </center>
</div>

And a more detailed screenshot of intrusive code, this time from my website: code detail

So, is this a bug of Chrome, something I broke somehow (I never saw these pieces of code) or malware? Any idea of how can I fix it?

I am using Google Chrome Version 21.0.1180.89 in Ubuntu (native from official page).

EDIT: I started a wiki answer. Please add your hacked extension to the list. I'm going to send an email to Google to see to inform them, but I think they might already be aware.

share|improve this question
2  
Looks like an annoying advert, have a look at chrome://extensions/ and see if there's anything weird. –  Rob W Sep 24 '12 at 20:32
    
Can you post a link to more info about anannoyingadvert please? I cannot find it googling. Everything looks fine there, the only possibility is that one of the extensions I use got hacked. Going to do some testing, brb. –  Frank Presencia Fandos Sep 24 '12 at 20:36
2  
Sorry, I missed my space bar. I've edited my comment to show my intended comment. Open a terminal, and run cd ~/.config/google-chrome/. Then, run grep -rie games-free-apps command to locate the file containing the code. –  Rob W Sep 24 '12 at 20:39
2  
Yes, it was an extension that was hacked (or maybe original publisher changed it to annoy everyone). Name: "Incognito Switcher 0.6", but suspiciously, the "Visit webpage" link of that extension is throwing an error. –  Frank Presencia Fandos Sep 24 '12 at 20:39
1  
How did this question get so much attention - especially from new users in the past twelve hours? Did you share the question on social media, or is this issue too common? –  Rob W Sep 25 '12 at 8:39
show 4 more comments

migrated from stackoverflow.com Sep 27 '12 at 4:12

This question came from our site for professional and enthusiast programmers.

5 Answers

I just had the same thing - the extension which was broken for me was one called Join Tabs... Dodgy!

share|improve this answer
2  
I deleted this and the problem was gone immediately. I've had this extension for a very long time, and have never had a problem with it before... Huh. –  GnomeSlice Sep 25 '12 at 0:15
1  
Same situation -- have used the extension for months at least and then this. –  Larry O'Brien Sep 25 '12 at 0:42
    
I'm trying this out as a replacement chrome.google.com/webstore/detail/…, it looks good –  Andrija Cacanovic Sep 25 '12 at 14:18
    
Same here. How does one flag an extension as malicious? –  andybak Sep 25 '12 at 14:38
add comment

I had the same problem and it turned out to be the extension "Web RSS Subscriber" that was to blame.

share|improve this answer
    
"Web RSS Subscriber 1.3" for me too –  Helpa Sep 25 '12 at 11:21
    
+1. There appears to be a replacement authored by Google, search for "RSS Subscription Extension (by Google)". –  Kos Sep 26 '12 at 6:41
add comment
up vote 7 down vote accepted

Apparently some extensions in Google Chrome, includying old and obsolete ones, have been hacked. If you are having the problem stated in the OP, please follow these steps and add the extension that causes the trouble to the list.

Known extensions that have been hacked:

  • Inkognito Tab Switch 2.2

  • Incognito Switcher

  • Join Tabs

  • Web RSS Subscriber

Steps to find out the rotten extensions:

  • Disable all your extensions. Options->Settings->Extensions

  • Enable the first one. Open a webpage where you have had the same problem, and check if it happens now.

  • If it happens, add that extension to the list. If it doesn't happen, disable that extension and repeat for the next extension.

share|improve this answer
add comment

I had the same problem with JoinTabs. At first I thought it was just an ad on the page until it started appearing on every webpage. I would suggest JoinTabs (no icon). It serves the same purpose but doesn't have the stupid ad appended to every page:

Link

You will need to drag and drop it into the extension window though since this is outside the Chrome Web Store.

share|improve this answer
add comment

I tracked down that Diigo Web Collector 2.26 had been hacked and html was being inserted into my documents, causing the site not to work. Added ID to body of dummybodyID and inserted divs with weird classes and display:none that apparently loaded 1276 x 0 images.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.