2

I starting doing some experimentation toward making a browser userscript for Google searches and when opening the JavaScript console noticed something that strikes me as very fishy:

The page at https://www.google.com.au/search?oq=XYZ&sourceid=chrome&ie=UTF-8&q=XYZ displayed insecure content from http://50.116.62.47/js/chromeServerV45.js.
The page at about:blank displayed insecure content from http://96.126.107.154/amz/google.php?callback=a&q=XYZ&country=US.

(XYZ is a placeholder for whatever the search terms really was.)

Is it likely that I've picked something like a drive-by browser infection? I've tried all kinds of searches for these URLs and other keywords but I've had no luck finding anything conclusive about whether they're malicious or what they are:

  • 50.116.62.47
  • chromeServerV45.js
  • 96.126.107.154
  • amz/google.php

The only extensions I have installed are either widely used or written by myself. But something else is strange and I'm not sure if it's just a coincidence. I updated my Windows Chrome browser today to version 23.0.1271.64 m and now my Extensions tab as well as my settings tab are blank, so I can't try disabling my extesions.

Here's some discussion I've been able to find so far but not really understand and make sense of:

Improve this question
5
  • Did you try running a malware scan with MalwareBytes or the like?
    – BrenBarn
    Nov 16, 2012 at 7:00
  • @BrenBarn: Spyboy Search & Destroy found only one DoubleClick cookie. Malwarebytes found nothing at all on its quick search and has now doing a full search for 1 hour 45 minutes without finding anything yet ...
    – hippietrail
    Nov 16, 2012 at 23:36
  • I went to 50.116.62.47 and it redirected me to localhost. I would guess the content is being served up from your computer? Take a look at open ports, is there anything on 80?
    – ta.speot.is
    Nov 17, 2012 at 0:34
  • @ta.speot.is: Yes I remember seeing the same. I'm running Windows 7 Starter and I'm a big vague on how to check for open ports...
    – hippietrail
    Nov 17, 2012 at 0:39
  • @BrenBarn: Malwarebytes has now completed. It found one thing only, called "PUP.HiddenStart.H" which was in xyz\Downloads\software (other)\hstart.exe. Now when I use Gmail or Google Search in Google Chrome I still get one warning but so far not the other. This one remains: http://66.228.34.50/js/chromeServerV45.js
    – hippietrail
    Nov 17, 2012 at 4:44

1 Answer 1

Reset to default
1

My extensions tab began working again and I've been able to go through the extensions one by one after running Spybot Search & Destroy and Malwarebytes.

I've discovered the source of 50.116.62.47/js/chromeServerV45.js was:

YouTube Downloader: MP3 / HD Video Download 13.0
Download any video from YouTube as an MP3 or an HD Video. Adds a download button to YouTube video pages. Visit website
ID: jkkeahicimadnjhdamcladhobabaafbg

I had installed it because it was an officially supported extension made by YouTube, which of course means made by Google. I notice it's no longer in the Chrome Web Store.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .