Searchfeedtech.com

[Getjava]

Hey,

I've been using Chrome Canary for a bit, but am switching back to regular chrome due to bugs and what not. When switching back (both on my Mac and Windows 10 machine) I noticed ads that redirect to searchfeedtech.com.

On my Windows computer I managed to find a solution using FRST, but I can't find a solution for Mac. Malwarebytes isn't detecting the malware, and there is no chrome extension that is added. 

Thanks.

[treed]

It seems odd that you would have the same behavior on both Mac and Windows. It's exceedingly unlikely that you would have accidentally installed the same adware on both machines at the same time.

Most likely what has happened is that the settings were changed on one machine and that was synced back to the other via Chrome sync. Since you've fixed it on Windows, I'd recommend resetting Chrome sync.

First, make sure Chrome is not running on the Mac.

Next, go here:

https://chrome.google.com/sync

Click the Reset Sync button at the bottom of that page. Make sure that your home page setting in Windows is set the way that you want, as that's what will be synced to your Google account. You may want to change the setting, then change it back again, just to make absolutely sure that Chrome sync has recorded your current home page setting

Then re-open Chrome on the Mac. See if it picks up the new settings.

[mymachasissues]

Hey. I'm also struggling to get rid of Search Feed Tech from my mac.

Screenshot attached of search results and all links run through searchfeedtech.com first. 

I've run Malwarebytes and AVG but neither are coming up with anything.

I also tried completely resetting Chrome, which seemed to help for about 12 hours but then I noticed it was back. 

Any thoughts on how to get rid of it?

 

[treed]

I actually see some of the same ad links displayed at the top of Google's search results sometimes. (It's not something that is entirely reproducible... I don't really understand Google's algorithms for when to display those ad links and when not to.) This is not the result of adware on your computer.

Those "top 10"/"top 5" antivirus sites are all scam sites, of course, but unfortunately they are a normal part of Google's search results. Scams often have a way of bubbling up to the top of Google's results.

[mymachasissues]

Yea seeing ads at the top of Google is obviously totally normal. They are setup by advertisers (not the algorithm).

I've attached a screenshot showing 'authentic' Google ads though (you can see the 'Ad' icon next to the link) vs the SearchFeedTech results. 

Every single ad link from the SearchFeedTech results goes via searchfeedtech.com before going to the destination.

You can see an example of the redirected SearchFeedTech links on the other screenshot (I opened in an incognito window).

Does that help clarify?

 

[mymachasissues]

Thought the attached might help too...

Am I right in saying this is adware at work?

[treed]

That code definitely does look suspicious... especially the reference to Yahoo, which you'd never find in a legit Google ad.

Can you try a few tests?

1) Test Safari

It looks like you're using Chrome. Are you seeing the same behavior in Safari? If not, there will be no need to do the rest of the tests.

2) Change networks

Connect your Mac to a different network, such as the wireless at a coffee shop, local library or friend's house. Do you still see the same issue?

3) Recovery mode

Second, restart your computer in recovery mode, by holding down command-R at startup. When it enters recovery mode, you will see four options, one of which is Get Help Online. (See the screenshot below.) Click that option, which will open Safari. Do the same test. Do you see the same issue?

[mymachasissues]

It's only happening in Chrome... 

 

 

Edited August 22, 2018 by mymachasissues

[treed]

Do you have any third-party Chrome extensions installed? If so, what are they?

[mymachasissues]

These are the ones I have... 

 

 

[mymachasissues]

I've just removed 'Page Ruler' and it seems to have fixed the issue. 

Strange as it's one I use fairly regularly and only noticed the problem recently. 

Thank you!

[treed]

Thanks for the info, I'll check out that Page Ruler extension.

Unfortunately, it's not unusual for a formerly legitimate Chrome extension to suddenly start misbehaving. Adware creators like to get hold of old, discontinued extensions, then they release an update that includes adware code.

[krumike]

Just had the same symptoms in chrome browser on a mac with Sophos Home and Malwarebytes protection.
I kept the page open while I investigated. But later when I went back, the links had changed to reasonable result links.

I used a few URL expanders but not showed me all the links from start to finish so couldn't check further.
VirusTotal didn't find anything suspicious about one of the long URLs I was able to check and doesn't flag SearchFeedTech as bad either https://www.virustotal.com/#/domain/searchfeedtech.com

I DO have Page Ruler chrome extension running. But, as I say I didn't do anything (except research) and the links have changed.
Hope this helps get to the bottom of this.
Oh yes.... I get the bad results in google.co.uk but when I tried google.com they were fine. But that may be luck depending on what the malware is doing.

[alvarnell]

I see there are at least three versions of Page Ruler and one of them appears to have been taken over by someone with other intentions. Here are a couple of recent reviews:

Ramesh KrishnamoorthyModified Aug 16, 2018

 

Beware of this extension. It manipulates the google results to bring partner's websites on top. After uninstalling google worked fine for me. As some other user reported, it may be even tracking and sending passwords. I could not verify this though

A Google User6 days ago

Confirmed, the extension inserts adds in google results

Bjarke WrangModified 3 days ago

 

ADWARE. GET A DIFFERENT EXTENSION.

This one hi-jacks your Google searches and injects ads (bypassing adblockers). Clicking any Google search result will open a tab with an ad.

[krumike]

Just found an example URL I had pasted into a URL expander
 

[link removed by moderators for safety]

Edited August 27, 2018 by treed
unsafe link

[krumike]

1 minute ago, alvarnell said:

I see there are at least three versions of Page Ruler and one of them appears to have been taken over by someone with other intentions. Here are a couple of recent reviews:

Ramesh KrishnamoorthyModified Aug 16, 2018

 

Beware of this extension. It manipulates the google results to bring partner's websites on top. After uninstalling google worked fine for me. As some other user reported, it may be even tracking and sending passwords. I could not verify this though

A Google User6 days ago

Confirmed, the extension inserts adds in google results

Bjarke WrangModified 3 days ago

 

ADWARE. GET A DIFFERENT EXTENSION.

This one hi-jacks your Google searches and injects ads (bypassing adblockers). Clicking any Google search result will open a tab with an ad.

I saw that too. But I'm not sure its the same extension (although it has the same name).
Before I removed the extension from my browser I used the link in Chrome Settings to "View in Chrome Web Store". The link failed. However, I searched the Chrome Web Store and found the same comments that you found.

[krumike]

BTW. There are more than 3 versions (although only 3 came up in my search in the Chrome Web Store too).
When viewing one of the found Page Rulers click on the related tab to see more.
{I may have got that wrong as the icons don't match}

Edited August 27, 2018 by krumike

[krumike]

Hmmm... I think there is another symptom related to this.

A few weeks ago I noticed a change in how Google ads were shown on a results page. I now suspect this was not a Goole change at all.

Instead of the little green box icon with [Ad] inside, ads were displayed without the icon but above and to the right of the top "ad" there was a small link which I think looked like [ Ad x] with no box around it. These as were also displayed in a split-second after the page was displayed. The page would flash as if a second pass ( or instant re-display ) of the page. That had seemed strange but I should have been more suspicious I realise now.

Now that the Page Ruler extension has been removed. Google ads appear as they used to. Hmmmmm.