31

I use the Google Chrome browser. Recently I noticed random ads showing up - either on the page content, or by redirection - when I click on a link an ad page opens instead of the proper page.

I suspect these ads are injected by a chrome extension, but how can I find the offending one?

The ads seem to appear at random in an intermittent manner.

Improve this question
10
  • Do you use an ad blocker, like AdBlock Plus? If so, it could just be that the ad definitions need to be updated so it recognizes all ads.
    – childofsoong
    Mar 25, 2015 at 23:16
  • 3
    If you're using Windows and it's an extension you did not install voluntarily, and it is listed under chrome://policy then you might find the unwelcome guest at %WINDIR%\System32\GroupPolicy\Machine or %WINDIR%\System32\GroupPolicy\User. Delete Registry.pol or any other .pol files if they exist at that location.
    – Vinayak
    Mar 26, 2015 at 4:03
  • 6
    @giorgio79 The Lastpass extension was definitely NOT inserting those ads.
    – EKW
    Mar 26, 2015 at 18:45
  • 2
    @GiacomoTecyaPigani: Chrome actually allows fine-grained control over which plugins should run: i.imgur.com/aQXthv4.png I use "click to run" for Flash.
    – Oliver Salzburg
    Mar 27, 2015 at 16:32
  • 1
    PS: It turned out the offending extension was Show / Hide passwords, not LastPass! I could follow back the injection via the network sources, and looking at the initiator scripts all the way to the plugin js file (Didier-content.js), so the solution was Giacomo's and Oliver's solution combined.
    – giorgio79
    Mar 28, 2015 at 20:20

6 Answers 6

Reset to default
45

Depending on your JavaScript knowledge, you can check out the scripts that can manipulate websites you visit.

  1. Press F12 to open the Developer Tools. Alternatively, open the Developer Tools from the "hamburger menu":

    enter image description here

  2. On the Sources tab, select the Content scripts tab. You should see a list of all your extensions that load content script.

    enter image description here

    "Content script" is the term that is used for scripts that are running in the context of the website you're visiting. These scripts have the ability to manipulate web content in any way they want.

  3. You can now inspect those scripts and see how they're messing with your page.

    Hint: In case they're using minified sources, enable the code beautifier:

    enter image description here

Improve this answer
0
32

My way is easier, since you don't have to examine extensions like AdBlock which don't add elements to your page :)

Also, If you aren't a tech-savvy, go to the bottom: there's any solution that may work for you...

  1. Open the Developer Tools

    Developer tools

  2. Open the Developer Tools in a new window and reduce the window to icon DockDock

  3. Browse the web and wait for the Ads to appear. In this case I'm using an extension which replaces ads with cats pictures

    cat picture

  4. Go to the Network tab, and look for the initiator column. Usually it's called something like content script.js. Click it and that's the content script that messed up your page.

    initiator

  5. If from taking a look at the code you can't guess which extension is, you can go to Sources tab, click on Content Scripts and look for the extension with a *.js file named like the one we found at point 4.

    last

Easier method (may be less effective)

  1. Go to the installed extensions page

    extension page

  2. For each extension, click on Details

    catblock

  3. If the Ads started popping up just recently, look for when it was updated. Chrome extensions update by themselves. This may help you if you started seeing ads today and casually the extension was updated today

    update date

  4. Last but not least, look at the reviews, preferably ordered by Recent. If you see somenthing like this, you may have found the culprit.

    User reviews

Improve this answer
4
  • I used this way to inspect my page in which using blank canvas chrome extension I am injecting code, But i do not see it in network tab. How so??
    – Suraj Jain
    Dec 16, 2017 at 10:02
  • Did you just responded, I saw notification but when I clicked it, there was not reply
    – Suraj Jain
    Dec 16, 2017 at 10:20
  • @SurajJain If the network tab is empty, than no connection was being made. Since ads must be downloaded, if you see ads than the network tab can't be empty. Either something you say it's wrong or it could be that what you are displaying is cached, but i'm not sure about the second
    – Giacomo Pigani
    Dec 16, 2017 at 12:20
  • Actually, I am myself injecting code, and I code see it in source code, it is working fine, I just wanted to see through network tab, but there it is not showing.
    – Suraj Jain
    Dec 16, 2017 at 12:28
22

Disable all chrome extensions, see if the problem stops. Enable each extension one by one. When the issue reappear, you have found the culprit.

Improve this answer
1
  • If you have really a lot of extensions, you can use the previous answer, given by Oliver, to help you selecting only the ones that change the pages display. Chrome hamburger menu -> More tools -> Developer tools -> "Content script" tab lists all the extensions that modify the display of the websites pages. howtogeek.com/213096/…
    – Quidam
    Feb 22, 2017 at 3:28
2

I've had a few customers reporting adware in their browser (all are/were using Google Chrome). They had a few randomly-named extensions, so I removed those. Along with a virusscan the extentions did not come back, but the ads were still popping up.

What was the solution? The Chrome executable was somehow infected. Located in either:

Program Files (x86)\Google\Chrome\Application\chrome.exe

Users{Username}\AppData\Local\Google\Chrome\Application\chrome.exe

Removing Chrome and installing it again worked flawlessly. Another way is updating Chrome, but that may require you to enable updates for Google Chrome:

In the registry editor in Windows (regedit): open the key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update. Set the UpdateDefault key value to 1.

After updating Chrome all adware was gone. Yay!

Improve this answer
-1

I've had a few customers reporting adware in their browser (all are/were using Google Chrome). They had a few randomly-named extensions, so I removed those. Along with a virusscan the extentions did not come back, but the ads were still popping up.

What was the solution? The Chrome executable was somehow infected. Located in either:

Program Files (x86)\Google\Chrome\Application\chrome.exe

Users{Username}\AppData\Local\Google\Chrome\Application\chrome.exe

Removing Chrome and installing it again worked flawlessly. Another way is updating Chrome, but that may require you to enable updates for Google Chrome:

In the registry editor in Windows (regedit): open the key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Update. Set the UpdateDefault key value to 1.

After updating Chrome all adware was gone. Yay!

Adding on to Brian's response...

Be sure to look out for any recent suspicious software names in either Program Files (x86) and AppData/Local, as well as any suspicious processes in Task Manager. Especially something like "OctaWare.xyz.exe", "BroowserENHuance" and "CoupMania".

Look in the Event Viewer for any additional info and be sure to search and delete their keys in the Registry.

Improve this answer
-3

The correct way to fully remove the software responsible:

Go to Menu

Click Settings

OR

Navigate to chrome://settings/ in your omnibar

Open "Extensions"

Click on "Developer Mode" check box

Below each extension it should list the full directory path and you can remove the file permanently from your system.

In my experience most ad-ware injectors currently hide in the C:/ProgramData folder. To view this you will likely have to enable hidden files from your folder view options. Most times they have a long string of random letters and numbers as their name. In the event that chrome doesn't show the full path to the extension, match up the id shown under the extension with the matching folder in C:\ProgramData and remove that folder. Restart Chrome and your ads should be gone.

Keep in mind that it could be an adware injector service installed under programs and features.

Take care when you are in that folder to only remove the entries for the extension and nothing else!

This is a better answer as it will apply to all websites, does not require an ad to appear, and also addresses the issue rather than simply overriding the offending software's script.

Improve this answer
3
  • Why mess with the filesystem when you can just uninstall the extension directly from the browser? Also, this doesn't address the problem in the question at all, which was how to find out which extension is injecting the ads. Removing said extension once you've found it should be trivial, which is why the existing answers don't discuss that step.
    – Ajedi32
    Mar 26, 2015 at 13:49
  • Because most of the ad-injectors that I've seen re-install after being removed from Chrome using the trashcan on the extensions screen. Buyandsave for one example. This is the only way I've found to actually remove the offender from chrome. You are correct that I did not answer his question.
    – That Guy
    Mar 27, 2015 at 0:38
  • Developer mode does not show the full path in chrome 43.0.2357.124. Just shows ID. Also note some malware extensions don't have their own extension entry. They are simply part of an extension you trust. Digging into the running process is the best way to identify related files.
    – jiggunjer
    Jun 19, 2015 at 11:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .