Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I starting doing some experimentation toward making a browser userscript for Google searches and when opening the JavaScript console noticed something that strikes me as very fishy:

The page at https://www.google.com.au/search?oq=XYZ&sourceid=chrome&ie=UTF-8&q=XYZ displayed insecure content from http://50.116.62.47/js/chromeServerV45.js.
The page at about:blank displayed insecure content from http://96.126.107.154/amz/google.php?callback=a&q=XYZ&country=US.

(XYZ is a placeholder for whatever the search terms really was.)

Is it likely that I've picked something like a drive-by browser infection? I've tried all kinds of searches for these URLs and other keywords but I've had no luck finding anything conclusive about whether they're malicious or what they are:

  • 50.116.62.47
  • chromeServerV45.js
  • 96.126.107.154
  • amz/google.php

The only extensions I have installed are either widely used or written by myself. But something else is strange and I'm not sure if it's just a coincidence. I updated my Windows Chrome browser today to version 23.0.1271.64 m and now my Extensions tab as well as my settings tab are blank, so I can't try disabling my extesions.


Here's some discussion I've been able to find so far but not really understand and make sense of:

share|improve this question
    
Did you try running a malware scan with MalwareBytes or the like? –  BrenBarn Nov 16 '12 at 7:00
    
@BrenBarn: Spyboy Search & Destroy found only one DoubleClick cookie. Malwarebytes found nothing at all on its quick search and has now doing a full search for 1 hour 45 minutes without finding anything yet ... –  hippietrail Nov 16 '12 at 23:36
    
I went to 50.116.62.47 and it redirected me to localhost. I would guess the content is being served up from your computer? Take a look at open ports, is there anything on 80? –  ta.speot.is Nov 17 '12 at 0:34
    
@ta.speot.is: Yes I remember seeing the same. I'm running Windows 7 Starter and I'm a big vague on how to check for open ports... –  hippietrail Nov 17 '12 at 0:39
    
@BrenBarn: Malwarebytes has now completed. It found one thing only, called "PUP.HiddenStart.H" which was in xyz`\Downloads\software (other)\hstart.exe`. Now when I use Gmail or Google Search in Google Chrome I still get one warning but so far not the other. This one remains: http://66.228.34.50/js/chromeServerV45.js –  hippietrail Nov 17 '12 at 4:44
add comment

1 Answer

My extensions tab began working again and I've been able to go through the extensions one by one after running Spybot Search & Destroy and Malwarebytes.

I've discovered the source of 50.116.62.47/js/chromeServerV45.js was:

YouTube Downloader: MP3 / HD Video Download 13.0
Download any video from YouTube as an MP3 or an HD Video. Adds a download button to YouTube video pages. Visit website
ID: jkkeahicimadnjhdamcladhobabaafbg

I had installed it because it was an officially supported extension made by YouTube, which of course means made by Google. I notice it's no longer in the Chrome Web Store.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.