Today I noticed that my google Chrome (Version 47.0.2526.111 m) has some extensions I didn't install on my own. And I'm pretty sure that I didn't install them on any of my devices I'm using (Win7, Ubuntu 14.04, Android, OSX).

Those two extensions are:

  1. uMatrix - which is actually a great security extension.
  2. Virtual Keyboard - I suppose that is also a nice thing to deal with keyloggers and co. If this is not a keylogger itself.

So now I'm asking myself how did this extensions appear in my browser? I don't think that its due to chrome update or something. I'm also using two step verification and I didn't notice any strange behavior on my mobile phone. So maybe some of you guys experienced the same problem? Or maybe someone knows how this can happen? Did somebody hack my account? So many questions... :)

I left my PC (running Win7) turned on over the night at work but I locked it super + L. Nobody knows my password (I hope). And one strange thing is that I had a running instance of Virtual Machine. And today after logging in no instances were running. The password I use is a pretty strong one (over 15 characters with numbers and capital letters)

  • No this didn't happen to us. Did you lend your computer to someone else ? – pun Jan 28 '16 at 10:32
  • @The_IT_Guy_You_Don't_Like I left my PC turned on at work but I locked it (Super + L) and any of my colleagues know my pwd. I had a running instance of Ubuntu VM running and today after login the instance wasn't there. Also strange. – Dimitri Podborski Jan 28 '16 at 10:37
  • Well you've just given those two extensions some google juice ... consider removing links – Ruskin Jan 28 '16 at 10:39
  • Both of those extensions have only been installed unless a user installed them. – Ramhound Jan 28 '16 at 11:33

Remove the extensions immediately if you didn't install them. Those extensions were not installed by any update of Chrome, Windows 7, OS X or Ubuntu. You don't want to have any malicious drive-by extensions hanging on like leeches in Chrome.

I'm just curious how something like this can happen.

Despite having seen it happen before in a computer that I was removing malware from, I don't know how extensions can hijack Chrome, but I suspected weak password management was at fault, so the only advice I can give is to change your passwords and don't use silly, weak passwords that are easy to hack. Also I had to backup the Chrome bookmarks, completely uninstall Chrome and then reinstall it with all sync options in Advanced sync settings unchecked, and restore Chrome's bookmarks from the backup in order to fix that problem.

Google Chrome has an application called Chrome Cleanup Tool that will scan and remove software that may cause problems with Chrome, such as crashes, unusual startup pages or toolbars, unexpected ads you can't get rid of, or otherwise changing your browsing experience.

Nobody knows my password (I hope).

If there is any chance that changing that password would help, I would change the password.

  • Yeah, I already removed those extensions. I'm just curious how something like this can happen. – Dimitri Podborski Jan 28 '16 at 10:31
  • Thank you for answering +1. But I thought that the bookmarks synchronization is managed by google account itself. But changing all the passwords is a good idea I guess :) – Dimitri Podborski Jan 28 '16 at 10:53
  • When I reinstalled Chrome, I unchecked all sync options in Advanced sync settings to make sure that the problem didn't come back, and also to be able to check whether or not the same problem would be reintroduced via synchronization. – karel Jan 28 '16 at 11:07

One possibility that come in my mind is that you installed recently an application. Because some extensions are installed while you run an application setup file. In other words, they are bonuses installed with or without your permission.

For example, developers of many free programme installers take benefits distributing other software in the same package. So you don't get 1 applications in the setup file only, but 3 or 4 browser extensions will be included.

  • Thanks for the point. I installed 2 apps in the last days, and just tried to reinstall them to check if it was caused by your assumption. But unfortunately without success. But your answer still might be useful for somebody. – Dimitri Podborski Jan 28 '16 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.