I starting doing some experimentation toward making a browser userscript for Google searches and when opening the JavaScript console noticed something that strikes me as very fishy:

The page at https://www.google.com.au/search?oq=XYZ&sourceid=chrome&ie=UTF-8&q=XYZ displayed insecure content from
The page at about:blank displayed insecure content from

(XYZ is a placeholder for whatever the search terms really was.)

Is it likely that I've picked something like a drive-by browser infection? I've tried all kinds of searches for these URLs and other keywords but I've had no luck finding anything conclusive about whether they're malicious or what they are:

  • chromeServerV45.js
  • amz/google.php

The only extensions I have installed are either widely used or written by myself. But something else is strange and I'm not sure if it's just a coincidence. I updated my Windows Chrome browser today to version 23.0.1271.64 m and now my Extensions tab as well as my settings tab are blank, so I can't try disabling my extesions.

Here's some discussion I've been able to find so far but not really understand and make sense of:

  • Did you try running a malware scan with MalwareBytes or the like? – BrenBarn Nov 16 '12 at 7:00
  • @BrenBarn: Spyboy Search & Destroy found only one DoubleClick cookie. Malwarebytes found nothing at all on its quick search and has now doing a full search for 1 hour 45 minutes without finding anything yet ... – hippietrail Nov 16 '12 at 23:36
  • I went to and it redirected me to localhost. I would guess the content is being served up from your computer? Take a look at open ports, is there anything on 80? – ta.speot.is Nov 17 '12 at 0:34
  • @ta.speot.is: Yes I remember seeing the same. I'm running Windows 7 Starter and I'm a big vague on how to check for open ports... – hippietrail Nov 17 '12 at 0:39
  • @BrenBarn: Malwarebytes has now completed. It found one thing only, called "PUP.HiddenStart.H" which was in xyz\Downloads\software (other)\hstart.exe. Now when I use Gmail or Google Search in Google Chrome I still get one warning but so far not the other. This one remains: – hippietrail Nov 17 '12 at 4:44

My extensions tab began working again and I've been able to go through the extensions one by one after running Spybot Search & Destroy and Malwarebytes.

I've discovered the source of was:

YouTube Downloader: MP3 / HD Video Download 13.0
Download any video from YouTube as an MP3 or an HD Video. Adds a download button to YouTube video pages. Visit website
ID: jkkeahicimadnjhdamcladhobabaafbg

I had installed it because it was an officially supported extension made by YouTube, which of course means made by Google. I notice it's no longer in the Chrome Web Store.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.