Hello there !
After visiting a few suspicious sites, while being on the hunt for a Sony Ericsson firmware file I ended up getting a nasty surprise.
First thing is that when I search for something in google, i sometimes (can't get the logic of when it actually happens) get a secondary search bar above the google one which is used as default, even if i try to type in the original google bar i get redirected to the secondary one. Even if I decide to use that one it redirects me to a yahoo search. I can get rid of it (temporary) by hitting the X button. But it comes back soon after.
The second issue is that from time to time, after a moderate interval of probably 10-20 mins, I get an ad pop-up triggered by a mouse click anywhere on the chrome page. ANYWHERE. Another thing i noticed is that the on-click ad somehow sets up a full-screen layer that has a HREF tag to an ad site. Meaning if i open it in chrome HTML explorer I see it as an element of the page, taking the entire visible space, making it impossible to not click it, unless u manually remove it from the DOM of the preloaded page.
I have tried 2 things , well more actually
- Kaspersky default antivirus I am using found nothing
- Malwarebytes found a file that was an adware, I removed it and restarted but the problem persists. After the second scan malware-bytes did no find anything wrong with my system.
- Some Bitdefender tool for dealing with adware, also found nothing wrong with my system.
- Tried removing any extensions from chrome that were unknown or weird (all I found were my extensions which I have been using for a long time), tried factory reset on chrome, tried re-installing chrome. Nothing seems to work. It seems to be bound to chrome since I dont have this problem in Edge (I dont have Firefox to try it there)
So I come to you. I can give you detailed information as to what IP address I get redirected and respectively connected to when I use the secondary search bar, the thing runs in SYSTEM (PID 4) and in Chrome.exe (PID random) but not as a separate process on its own.
From here on I am opened for suggestions. Thank you in advance and I wish both of sides good luck.