3

As title, seems there's a trojan on my server
When I put a url like

localhost/mysite

it redirect to the site free-merchants.com and then return to my site...
But if I put

127.0.0.1/mysite

all work correctly...
Then, what is? I scan with avast and malwarebytes and no virus...
With HijackThis I can't see any strange thing... File hosts have only row

127.0.0.1 localhost

Can be a bug of my webserver that run with

Apache/2.2.21 (Win32) PHP/5.4.32

Or what I must scan?

Improve this question
2
  • Maybe the browser is compromised?
    – Moab
    Jan 18, 2016 at 15:56
  • 1
    What happens if you ping localhost? Does it go out to an external IP?
    – ethanwu10
    Jan 18, 2016 at 16:23

2 Answers 2

Reset to default
2

I have the same problem as well.

Seems like a trojan hidden in one of the Chrome extension. Just don't know which one.

I have found this webpage on the same topic: http://www.eenyhelp.com/answer/bug-811371-chromium-unwanted-redirection-chromium-help-215926861.html

Quick and dirty way to block it: block access to www.free-merchants.com (either on the router or at least in hosts file on the local PC)

Proper way: find the guilty extension and disable it.

Improve this answer
5
  • Thanks, the problem was extension "Translate selection"... Disabled it no problem now
    – Onofrio De Divitiis
    Jan 18, 2016 at 19:33
  • The big question now is if that is only what it did or if you should consider your PC compromised. (e.g. no longer trust anything on it. No internet banking, no amazon, no paypall, ... ....). At least not until full wipe and reinstallation
    – Hennes
    Jan 19, 2016 at 10:26
  • I guess the PC is not compromised. Chrome Extension is running in the webpage sandbox and should not be able to infect the PC otherwise. The other question would be if your passwords got compromised, which maybe could happen via the redirection. Maybe it is time to change the passwords at the webpages that you often use. And eventually enable two-factor authentication, if the service allows.
    – Honza Skýpala
    Jan 19, 2016 at 12:17
  • "Incognito this" extension in my case.
    – Zenklys
    Jan 24, 2016 at 16:09
  • In my case it also was 'Translate selection'. Could it be that some kind of a malware program modifies these extensions after installation? I don't think that they come infected from the store...
    – ebutusov
    Feb 8, 2016 at 17:13
2

For me it was the chrome extensions "Facebook Album Downloader". Deactivate and it is gone. I reported it on the Chrome store. You should to the same.

I found it by deactivating all Chrome extensions and then re-activating them one by one until the problem shows up.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .