Jump to content

"brought by shopping deals" malware only in Chrome, blocking extensions access


Recommended Posts

OK, this is a weird one. I've looked everywhere & can't find any info on it.

It is only showing up in Chrome for Mac, and only popping up when I'm on Amazon.com

This is what it looks like: ads-by-shopping-deals.jpg except mine is always links to Walmart items. It has tools somewhere that I can't find, one of which closes any window attempting to go to "chrome:\\extensions". I've navigated on the Mac hard drive to everywhere there could be rogue extension and no luck.

Anyone  have any ideas?

 

Thanks!

 

Flipper

Link to post
Share on other sites

  • Staff

Flipper,

First, scan for adware using Malwarebytes Anti-Malware for Mac if you haven't done so already:

https://malwarebytes.com/antimalware/mac

If that doesn't come up with anything, the fact that it's specific to Chrome and isn't happening in Safari means it's almost certainly a Chrome extension. It may also have components elsewhere, but most likely it's just a Chrome extension.

If you can post a system snapshot taken with Malwarebytes Anti-Malware for Mac here - or send it to me via direct message - I can take a look and see what looks suspicious, and then help you get rid of it. To do so, open Malwarebytes Anti-Malware for Mac and choose Take System Snapshot from the Scanner menu. Then, in the window that opens, select all the text (Edit → Select All), copy it and paste into a reply to this message (or a direct message if you'd prefer).

Link to post
Share on other sites

On 10/6/2016 at 1:12 PM, treed said:

Flipper,

First, scan for adware using Malwarebytes Anti-Malware for Mac if you haven't done so already:

https://malwarebytes.com/antimalware/mac

If that doesn't come up with anything, the fact that it's specific to Chrome and isn't happening in Safari means it's almost certainly a Chrome extension. It may also have components elsewhere, but most likely it's just a Chrome extension.

If you can post a system snapshot taken with Malwarebytes Anti-Malware for Mac here - or send it to me via direct message - I can take a look and see what looks suspicious, and then help you get rid of it. To do so, open Malwarebytes Anti-Malware for Mac and choose Take System Snapshot from the Scanner menu. Then, in the window that opens, select all the text (Edit → Select All), copy it and paste into a reply to this message (or a direct message if you'd prefer).

Thanks Thomas, 

 

I've PM'd you

Link to post
Share on other sites

  • Staff

I don't see anything terribly concerning in your system snapshot. It looks like you just have Google extensions in Chrome, plus LastPass, which is legit.

I do notice that you have Avast installed, and they've been known to do this kind of thing before:

http://www.thesafemac.com/avast-installs-adware/

However, I haven't heard any complaints that they're doing this again, and previously it was done using their browser extension, which you only have installed in Firefox.

The first thing I'd recommend doing is resetting Chrome. To do that, open Chrome's preferences, then scroll down and click the "Show advanced settings" link. Then scroll down again and click the "Reset settings" button.

If that doesn't fix the problem, try uninstalling Avast and see if that makes a difference.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.