Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm getting redirected to ezshoplist.me and alecyueee.us, when I try to access amazon.com. I'm actually redirected to these sites which redirects back to Amazon.com. I searched a lot regarding these domains and came across this link - ddecode.com.

Also came across this site alestat which also indicates connections between amazon, ezshoplist.me and alecyueee.us

  1. Can someone help me understand what this code does?
  2. Has my Amazon credentials/session been compromised?
  3. How do I figure out which extension is the culprit?

As of now, I'm using a Chrome extension - Block site, to block these two sites and it does a pretty good job in doing the same. But I would like to get this removed. Virus/Malware scan with ClamXav and AVG free did not help.

Browser : Chrome
OS: Mac OSX 10.7.5

share|improve this question
2  
In the worst case you have a malicious infection. In the best case you have a fake/adware extension installed. What have you done to clean your system? Have you simply deleted your Chrome profile? Once you resolve this problem you should change your Amazon credentials. –  Ramhound Sep 11 '13 at 15:56
    
As mentioned I've scanned system with antivirus/malware. I uninstalled chrome, cleared profile etc, reinstalled it and sync'd my extensions back from cloud. I still have the issue. I'll change my Amazon credentials only after making sure that issue is completely resolved. But I need help on that. –  rajivvishwa Sep 11 '13 at 16:00
    
Skip syncing the profile, and I glazed over the fact your on OS X, so a malcious infection is highly unlikely. Which leaves a malicious ( i.e. unwanted behavior ) extension installed by you. Does this happen with Safari or Firefox? I suspect its your DNS or ISP Provider introducing this behavior through javascript. –  Ramhound Sep 11 '13 at 16:18
    
Forgot to mention - I'm using Google DNS servers, my hosts file is clean too. This is happening only on Chrome (Not on incognito). Its clear that some extension is causing the issue. And someone has posted the code of extension in link mentioned in my post. But I'm not sure I could figure out what it does. If I could figure out I may be able to track the extension and remove it. And of course, report it to Google. –  rajivvishwa Sep 11 '13 at 16:49
    
Process of elimination is the best way to find this. Remove one extension at a time until the problem returns. Syncing your profile after the removal of the profile is likely the reason it returned. Try starting chrome with extensions to verify its actually an extension doing it. –  Ramhound Sep 11 '13 at 16:56

3 Answers 3

I have the same thing. I've got 3 computers all synced by Chrome and the problem comes back. Mac and PC both do it. It is basically an affiliate redirect so someone is getting paid every time, which I wouldn't mind if I knew who it was. eliminating now so will post results. I reckon it's Adblock Plus but can't be sure.

EDIT: Ironically it looks to be the DoNotTrackMe extension! ABP seems to be fine.

share|improve this answer
    
Please be more precise with the answer - is it now the "DoNotTrackMe" extension? Was the problem solved after you deleted the extension? –  FiveO Jun 26 at 10:15
    
i think i have found the culprit, there is code in the chrome extension "Fabulous for Facebook" that redirects the browser when visiting amazon, just like in the OP. –  mack nordstrum Aug 29 at 16:08

I think i have found the extension causing your issue. I was a bit suspicious of the extension so checked out its code, and found an obfuscated bit of javascript that seems to do what you are suggesting. The extension is called "Fabulous for Facebook". Do you have that installed? If so, uninstall it, and the problem should go away.

share|improve this answer

In my case, the problem was a chrome plugin/extension called "Photo Zoom for Facebook". This plugin/extension used to open a new tab each time I opened Chrome in Incognito mode and automatically go to http://alecyueee.us/ext url which then redirected me to download a plugin/extension called "Fabulous for Facebook".

Please do not use this plugin (Photo Zoom for Facebook) and not only disable but remove it from your chrome, it maybe tracing your secret data. So better to be careful.

Google should check before adding these extensions to their store.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.