Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I seem to have been infected by malware. Specifically, every now and then (once every few days usually) I get redirected to a page that asks me to download something, usually a "new version of Flash". Presumably, it is nothing of the kind, but is actually a virus or trojan of some sort.

I am using google-chrome version 30.0.1599.114 on Debian Linux and am pretty sure that this is caused by an extension. I know I could simply uninstall my extensions or delete my ~/.config/google-chrome folder, but I would rather not do it. I would like to identify the extension causing this and remove only that.

In attempting to debug this (thanks @Braiam), I have checked the events logger in chrome://net-internals/#events and searched for one of the URLs that I am redirected to:

Screenshot of Chrome's event logger

The contents of the chrome://net-internals/#events are:

Start Time: 2014-03-03 17:28:41.358

t=1393864121358 [st=  0] +REQUEST_ALIVE  [dt=334]
t=1393864121359 [st=  1]   +URL_REQUEST_START_JOB  [dt=332]
                            --> load_flags = 134349184 (ENABLE_LOAD_TIMING | ENABLE_UPLOAD_PROGRESS | MAYBE_USER_GESTURE | VERIFY_EV_CERT)
                            --> method = "GET"
                            --> priority = 2
                            --> url = ""
t=1393864121359 [st=  1]      HTTP_CACHE_GET_BACKEND  [dt=0]
t=1393864121359 [st=  1]      HTTP_CACHE_OPEN_ENTRY  [dt=0]
                              --> net_error = -2 (ERR_FAILED)
t=1393864121359 [st=  1]      HTTP_CACHE_CREATE_ENTRY  [dt=0]
t=1393864121359 [st=  1]      HTTP_CACHE_ADD_TO_ENTRY  [dt=0]
t=1393864121359 [st=  1]     +HTTP_STREAM_REQUEST  [dt=1]
t=1393864121360 [st=  2]        HTTP_STREAM_REQUEST_BOUND_TO_JOB
                                --> source_dependency = 122670 (HTTP_STREAM_JOB)
t=1393864121360 [st=  2]     -HTTP_STREAM_REQUEST
t=1393864121360 [st=  2]     +HTTP_TRANSACTION_SEND_REQUEST  [dt=0]
t=1393864121360 [st=  2]        HTTP_TRANSACTION_SEND_REQUEST_HEADERS
                                --> GET /p/d9/32/a3/72/d932a372371bd0a47ba7e2a73649a8d0.swf? HTTP/1.1
                                    Connection: keep-alive
                                    User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.114 Safari/537.36
                                    Accept: */*
                                    DNT: 1
                                    Accept-Encoding: gzip,deflate,sdch
                                    Accept-Language: en-US,en;q=0.8,fr;q=0.6
t=1393864121360 [st=  2]     -HTTP_TRANSACTION_SEND_REQUEST
t=1393864121360 [st=  2]     +HTTP_TRANSACTION_READ_HEADERS  [dt=330]
t=1393864121360 [st=  2]        HTTP_STREAM_PARSER_READ_HEADERS  [dt=330]
t=1393864121690 [st=332]        HTTP_TRANSACTION_READ_RESPONSE_HEADERS
                                --> HTTP/1.1 200 OK
                                    Server: Apache
                                    ETag: "d932a372371bd0a47ba7e2a73649a8d0:1393776550"
                                    Last-Modified: Sun, 02 Mar 2014 16:09:10 GMT
                                    Accept-Ranges: bytes
                                    Content-Length: 5255
                                    Content-Type: application/x-shockwave-flash
                                    Date: Mon, 03 Mar 2014 16:28:41 GMT
                                    Connection: keep-alive
t=1393864121690 [st=332]     -HTTP_TRANSACTION_READ_HEADERS
t=1393864121690 [st=332]      HTTP_CACHE_WRITE_INFO  [dt=0]
t=1393864121690 [st=332]      HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121690 [st=332]      HTTP_CACHE_WRITE_INFO  [dt=0]
t=1393864121691 [st=333]   -URL_REQUEST_START_JOB
t=1393864121691 [st=333]    HTTP_TRANSACTION_READ_BODY  [dt=0]
t=1393864121691 [st=333]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121691 [st=333]    HTTP_TRANSACTION_READ_BODY  [dt=1]
t=1393864121692 [st=334]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121692 [st=334]    HTTP_TRANSACTION_READ_BODY  [dt=0]
t=1393864121692 [st=334]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121692 [st=334]    HTTP_TRANSACTION_READ_BODY  [dt=0]
t=1393864121692 [st=334]    HTTP_CACHE_WRITE_DATA  [dt=0]
t=1393864121692 [st=334] -REQUEST_ALIVE

And of the URL_REQUEST:

Start Time: 2014-03-03 17:28:41.359

t=1393864121359 [st=  0] +DISK_CACHE_ENTRY_IMPL  [dt=350]
                          --> created = true
                          --> key = ""
t=1393864121690 [st=331]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 304
                            --> index = 0
                            --> offset = 0
                            --> truncate = true
t=1393864121690 [st=331]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 304
t=1393864121690 [st=331]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 0
                            --> index = 1
                            --> offset = 0
                            --> truncate = true
t=1393864121690 [st=331]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 0
t=1393864121690 [st=331]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 0
                            --> index = 2
                            --> offset = 0
                            --> truncate = true
t=1393864121690 [st=331]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 0
t=1393864121691 [st=332]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 2612
                            --> index = 1
                            --> offset = 0
                            --> truncate = true
t=1393864121691 [st=332]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 2612
t=1393864121692 [st=333]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 1448
                            --> index = 1
                            --> offset = 2612
                            --> truncate = true
t=1393864121692 [st=333]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 1448
t=1393864121692 [st=333]   +ENTRY_WRITE_DATA  [dt=0]
                            --> buf_len = 1195
                            --> index = 1
                            --> offset = 4060
                            --> truncate = true
t=1393864121692 [st=333]   -ENTRY_WRITE_DATA
                            --> bytes_copied = 1195
t=1393864121693 [st=334]    ENTRY_CLOSE
t=1393864121709 [st=350] -DISK_CACHE_ENTRY_IMPL

Scanning the DISK_CACHE_ENTRY shows it to be clean:

$ sudo clamscan -r .config/google-chrome/
Known viruses: 3138491
Engine version: 0.97.8
Scanned directories: 543
Scanned files: 1511
Infected files: 0
Data scanned: 70.93 MB
Data read: 135.29 MB (ratio 0.52:1)
Time: 22.528 sec (0 m 22 s)

The pages served are often (perhaps always, not sure) on the google-chrome directory with clamscan directory returns:

$ grep -lR adnx .config/google-chrome/
.config/google-chrome/Default/History Provider Cache
.config/google-chrome/Default/Current Tabs
.config/google-chrome/Default/Archived History
.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/#SharedObjects/Y255TG9H/
.config/google-chrome/Default/Pepper Data/Shockwave Flash/WritableRoot/#SharedObjects/Y255TG9H/

My installed add-ons follow. These are from Chrome's add-ons store:

"View Vote totals" without 1000 rep
AutoReviewComments 1.3.0
Chat Reply Helper for Stack Exchange sites 2.4.0
Close Tabs 1.1
Desktop Notifications for Stack Exchange
Docs PDF/PowerPoint Viewer (by Google) 3.10
Edit with Emacs 1.13
Hangout Chat Notifications 2.0.0
IE Tab
KBD Button for Stack Exchange sites 0.2.0
Sexy Undo Close Tab 7.4.13
Smooth Gestures 0.17.14
SmoothGestures: Plugin 0.9.1
Yet another flags

These are from Stack Apps:

Dude, where's my cursor 1.0
SE Comment Link Helper 1.0
Super User Automatic Corrector 1.0
threading-comments 1.0
stackexchange-tab-editing 1.0

Installed plugins:

Screenshot showing installed plugins

How can I use this (or any other) information to identify which add-on is causing this?

share|improve this question
The only way I know is a trial and error approach. – Ramhound Mar 3 '14 at 16:44
@Ramhound yeah. The problem is that since this only occurs rarely, once every few days, the trial and error approach could take months which is why I haven't tried it yet. – terdon Mar 3 '14 at 16:48
@terdon | clamscan was exactly what I was thinking of. Since it's somewhat intermittent you are unlikely to find out the extension short of shutting them down and adding them over a period of time. This assumes it is an extension issue. Have you noticed anything consistent in your activity when the problem occurs? – Matthew Williams Mar 3 '14 at 16:49
@MatthewWilliams nothing at all. It seems completely random, I do know it only happens in chrome though. I can be reading a post here for example and with no clicks, I suddenly get redirected to an add/download page. – terdon Mar 3 '14 at 16:57
Just a note, you don't need to disable your extensions one at a time. Disable half of them for a few days, and soon enough you'll have narrowed the field by half (unless you have more than one infected extension). – alexis Mar 3 '14 at 22:16

I'm not sure if this is the case in your particular issue but there have been situations where known good extensions have been sold to 3rd parties who then co-opt the extension for nefarious purposes. Here is one such story that discusses this: Google Chrome Extensions are Being Sold to Malicious Adware Companies.


Ron Amadeo from Ars Technica recently wrote an article about adware vendors buying Chrome extensions in order to place malicious, ad-injected updates.

Google Chrome has automatic updates in order to make sure that the users always running on the latest updates. Obviously, Google Chrome is updated directly by Google. However, this update process consequently includes Chrome’s extensions. Chrome extensions are updated by the extension owners, and it is up to the user to determine if the extension owner is trustworthy or not.

When users download an extension, they are giving the extension owner permission to push new code out to their browser at anytime.

What has inevitably happened is that adware vendors are buying the extensions, and therefore the users, from extension authors. These vendors are pushing adware out to every user of the extension, which can make for a dangerous browsing experience.

One Google extension author gave his personal account of this in his blog post entitled, “I Sold a Chrome Extension but it was a bad decision.”

My advice would be to take this situation very seriously and disable extensions that you're not sure about. I would then monitor the situation to see if it subsides or continues.

If it continues then I would dig deeper and start to scrutinize the DNS servers you're using. I typically use OpenDNS for this exact reason, since this service (free) attempts to thwart attack vectors by redirecting DNS lookups to alternative OpenDNS pages instead.

Why care about DNS?

OpenDNS DNS servers will intentionally augment the results they return when you do a lookup if a hostname is known to be affiliated with spam/hacking/phishing related activities. They're in a unique position since they perform the lookups for every site their customers traffic, so they can detect anomalies see here: OPENDNS PHISHING PROTECTION, as well as here.

What else?

I would also make sure that your /etc/hosts file hasn't been compromised, and continue to monitor the situation using something like nethog, which will show which processes are accessing your network.

Amit Agarwal created a Feedly extension for Chrome in less than an hour and sold it unknowingly to an Adware vendor for a 4-figure offer. The extension had 30,000+ users on Chrome at the time of sale. The new owners pushed an update to the Chrome store, which injected adware and affiliate links into the users’ browsing experience. While this extension has been removed due to the publicity that Agarwal’s remorseful confession made, this is a very common event in Chrome extensions.

share|improve this answer
Yeah, I figure something like that is going on. I can confirm that my hosts file is clean and will switch to OpenDNS just in case. Thanks. – terdon Mar 3 '14 at 17:40
OpenDNS made no difference. I guess it considers these valid requests. – terdon Mar 5 '14 at 1:54
@terdon - they may not have detected this issue as of yet. – slm Mar 5 '14 at 1:59

Take a look at the reviews of the extension Smooth Gestures (direct link).

If you sort the reviews by date (by clicking Recent), you'll see that almost all new reviews have a one-star rating and complain about underhanded ads:

Kevin Lee 1 day ago

Sold to a third-party company that adds ads, and a pay-to-remove-ad feature.

Suresh Nageswaran 3 days ago

Hate the ads. Worked good until it started injecting ads into my browsing experience. I would have paid to continue to use it, but I felt strongly about the sneakiness. Borderlines on spyware.

John Smith 6 days ago

Do not use this. It is injecting JS to clickjack things and causes XSS security problems with https.

Tomas Hlavacek Feb 23, 2014

Absolute crap... Remember the incident with unauthorized URL sneaking? Then they started to force users to "donate" or suffer ads. It even started to lag on certain pages (which was not the case before all those "improvements"). So I have switched to CrxMouse and I am fine.

kyle barr Feb 19, 2014

It's a solid mouse gestures extension, but the new ads are a horrible addition. First because the extension updates and silently adds the ads, so you don't know where they're coming from. Here I am scanning my computer with multiple malware scanners because I'm getting random ads, until I realize it's Smooth Gestures inserting them.

There's no good reason to use this extension any longer, and personally I'd like to know who develops this extension so I can make sure not to install anything from them in the future.

Looks like that one's the culprit.

share|improve this answer
Ah, now that does indeed look promising. Thank you, I will reinstall the ones I've already removed and just remove this one. I won't accept yet since it will take a few days to be sure, but I'll come back and let you know. – terdon Mar 4 '14 at 3:27
Glad you seemingly found the culprit. There is a similar extension called SmoothScroll which appears to have the same problem. The one with more reviews, if you look in the ratings, same deal as this one! – slm Mar 4 '14 at 12:27
@terdon: I think I found a useful extension. Extensions Update Notifier shows a desktop notification every time an extension is updated. – Dennis Mar 12 '14 at 17:35
Thanks @Dennis! I added it to my answer. – terdon Mar 12 '14 at 17:38

I'm going to focus in the detection methods.

Check the changelogs

This seems to be obvious. Check the chrome extension page for changelogs, compare when the extensions were last updated with when the behavior started. This is a good pointer in case you want to accurately identify the extension at fault.

Parse the background scripts

In the chrome extension manifest.json file, look for the background object, something like this:

  "background" : {
    "persistent" : true,
    "scripts" : [

These scripts are normally run all the time while the extension is active and is the most common attack vector. Parsing the text for:

chrome.extension.sendRequest({action: "opentab"

and the domain names (like adnxs) is a good approach. This won't work if the files are in some way obfuscated which is also a pointer that something fishy is undercover.

Elimination by bruteforce

The easier, but in your case, lengthy method is deactivating one by one the extensions until by elimination you identify the culprit.

Check the socket events

This is the most advanced but it won't pinpoint an extension but is a way to gather information, the only drawback is that chrome/ium may remove events when memory get exhausted and it introduces a bit of overhead.

Compare your extensions with other affected

If two people has the same problem and there's only one extension in common, they can safely presume that the extension is the culprit and disable it. If that doesn't work, then the extension is clean and they can compare with others.

share|improve this answer
Hmm, nice tip on parsing the background stuff, will do that now. Unfortunately, the thing tends to hijack an existing tab so no opentab or create necessary. Any pointers on what I should search for? Something like a GET request I guess. – terdon Mar 3 '14 at 18:13
@terdon in case of highhacking the current window, I would check for the contentscripts instead. Wait, I will get some screenies – Braiam Mar 3 '14 at 18:16
Yeah, nothing obvious in the manifest.json files. Where/what are the contentscripts? – terdon Mar 4 '14 at 2:58
up vote 4 down vote accepted

In addition to the answers here, I found a few more useful resources.

  1. This howtogeek article recommends a program called Fiddler that acts as a web debugging proxy, allowing you to examine network requests (there's an alpha linux version). @slm pointed me to this answer on SO that has various similar programs as well.

  2. The developer mode in chrome's chrome://extensions page allows you to check each extension for processes running in the background:

    enter image description here

    Clicking on background.html opens chrome's developer tools window which allows you to easily look through the sources of the various scripts that the extension contains. In this case, I noticed a folder called support in Sexy Undo Close Tab's source tree that contained a script called background.js that looked suspicious (it was generating random time intervals which fits my symptoms).

  3. This other howtogeek article has a list of known extensions to avoid, but even better is which seems to be a user generated database of malicious extensions. However, they don't specify how or why a particular extension has been tagged as mal- or addware so perhaps it should be taken with a grain of salt.

  4. The people behind (whoever they are) have also developed a very cool little extension called, (drumroll) Extension Defender. This both lets you scan your existing extensions for known "bad" ones and also blocks blacklisted extensions from being installed.

So of the extensions in my OP, both Smooth Gestures (thanks @Dennis) and Sexy Undo Close Tab are addware. Based on the source code of the support/background.js file of the latter, I'm pretty sure that one was the one randomly hijacking my current page but I'll give it a few days to be sure.

Another useful extension is Extensions Update Notifier (thanks @Dennis) which apparently lets you know whenever an extension haqs been updated which could help identifying the culprit in case an updated added this type of behavior.

share|improve this answer
OK I gotta ask, what the hell is sexy undo close tab? – slm Mar 5 '14 at 2:00
@slm heh, that's why I made sure [edit: thought I had made sure, link added now] the name was a link, so no one misunderstands its purpose :). It's just an "reopen closed tabs" extension and the devs decided on that ridiculous name. – terdon Mar 5 '14 at 2:02
fiddler is windows only BTW. You can use mitmproxy on Linux.… – slm Mar 5 '14 at 2:04
@slm no it's not, they have an Alpha version based on Mono that they claim should work on Linux and OSX. There's a link to it on the downloads page. – terdon Mar 5 '14 at 2:13
Who's David? :P – Dennis Mar 5 '14 at 2:35

A good place to start is with the chrome extension "shield for chrome." It will help uncover extensions with KNOWN issues. It's available on the Chrome Web Store, is free, lite and really easy to use.

Or "Extension Defender."

share|improve this answer

If you have the Wine Windows Emulator installed, it may be infected, and Chrome is opening because the malware is opening the default browser.

You could try moving/deleting the ~/.wine directory and restarting the machine. I had the same problem a few months ago and that's how I solved it.

In hindsight, I wish I'd kept a copy of the directory in order to determine the specifics of the infection. At the time I didn't know this method would work, nor how extensive the infection was, so I opted to just delete the whole thing.

share|improve this answer

Are you sure it's actually malware? There has been a rash of ads themselves causing redirects, etc. and since they're able to run quite a bit of JavaScript, they could do it with a delay. The fact that your request debugging shows what I believe is an ad delivery platform suggests that may be somewhere to look.

I would try an ad blocker. (Not quite sure what's good on Chrome these days, though.)

share|improve this answer
Pretty sure, I get this behavior on sites I am fairly sure are malware-free, this one for example. Since I have enough rep, there are no adds on the SE sites I frequent and I still get these annoying redirections. – terdon Mar 3 '14 at 19:57
It's not the sites that are malware-ridden; it's the ad networks they use. Ad buyers have been buying up ads and sneaking their own code in. – zigg Mar 3 '14 at 21:36
Well yes, but since I don't see the ads I am assuming they don't get served to my browser. Only new users see ads. – terdon Mar 3 '14 at 23:16

99% of this seems to be Windows only - but nevertheless try following this guide.

From what you have posted it's impossible to tell which extension is causing those issues.

Good luck!

share|improve this answer
Thanks but as you said, that's all for Windows. The only OS-agnostic suggestion is to remove all add-ons not installed by me (all of them were). – terdon Mar 3 '14 at 16:56
@terdon - start with extensions update since this problem started. – Ramhound Mar 3 '14 at 17:00
@terdon There is a lot of stuff browser-related! Try disabling all extensions and stay with the ones which you really need. Try Firefox and see if there are similar extensions. Check all extensions - one by one on - Google. Maybe someone has reported similar problem? Post the list of all extensions you have installed. – Chris Mar 3 '14 at 17:07
@Ramhound thanks but most of them were installed on the same day. – terdon Mar 3 '14 at 17:07
@Chris I know it is chrome specific, and that's exactly what I want to avoid. Since it only happens every few days, debugging one by one could take months. I added my list of extensions to the OP. – terdon Mar 3 '14 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .