Chrome Malware?

[Andrzej1]

For about the last week Chrome has been trying to open tabs not requested by me. They are the same tabs over and over. They are as follows:

 

chrome-extension://ihcjicgdanjaechkgeegckofjjedodee/redirects/blockedDownload.html?url=http%3A%2F%2Fwww.radiosure.com%2Fdownloadz%2Fdownloadz-select%2F&host=www.radiosure.com&type=scam&subtype=suspiciousDownload

 

chrome-extension://ihcjicgdanjaechkgeegckofjjedodee/redirects/blockedDownload.html?url=https%3A%2F%2Fstreamwriter.org%2Fen%2Fdownloads%2F&host=streamwriter.org&type=scam&subtype=suspiciousDownload

 

chrome-extension://ihcjicgdanjaechkgeegckofjjedodee/redirects/blockedDownload.html?url=https%3A%2F%2Fwww.slickvpn.com%2Fupdate%2F&host=www.slickvpn.com&type=scam&subtype=suspiciousDownload

 

chrome-extension://ihcjicgdanjaechkgeegckofjjedodee/redirects/blockedDownload.html?url=http%3A%2F%2Fwww.studiotax.com%2Fen%2F%3Fpage%3D2&host=www.studiotax.com&type=scam&subtype=suspiciousDownload

 

chrome-extension://ihcjicgdanjaechkgeegckofjjedodee/redirects/blockedDownload.html?url=http%3A%2F%2Fliveupdate.symantecliveupdate.com%2Fupgrade%2FRnR%2FNRnR.exe&host=liveupdate.symantecliveupdate.com&type=scam&subtype=suspiciousDownload

 

This behavior happens about twice a day. Fortunately the Malwarebytes extension is blocking these attempted downloads. I am at a loss to find the cause of this behavior. The AV I use is McAfee and I have run various scans such as Malwarebytes, Adwcleaner, ESET OnlineScan and even Norton Power Eraser which have found nothing. I was wondering what was the best way to identify and remove the process trying to launch these pages?

 

As a temporary fix I am thinking of simply blocking the offending domains in Chrome although I occasionally use some of them in which case I would switch to another browser. I have not experienced any problems with my computer (Win 10 Pro) or other browsers such as IE or Firefox.

[dcollins]

Does this only happen after you open the browser and then attempt to download a file? We are working on a fix for that issue right now.

[Andrzej1]

2 minutes ago, dcollins said:

Does this only happen after you open the browser and then attempt to download a file? We are working on a fix for that issue right now.

I am not 100% sure but yes quite often when attempting to download a file.  For instance this happens quite often when I attempt to download a .acsm file from Overdrive,  Chrome is set to automatically open these files in ADE.  This is the most often seen trigger for the event. 

Your comment seems to imply that this problem is with your extension and not some malicious virus. Is this correct?

[dcollins]

If you're trying to download a file and you get multiple tabs that open up to other files, then yes, it's a bug in our extension we're fixing. But if you're getting a block on one specific file when you try to download it, it could be a malicious file. The URL's your provided don't really help, but a screenshot of what you're seeing could.

[Andrzej1]

2 hours ago, dcollins said:

If you're trying to download a file and you get multiple tabs that open up to other files, then yes, it's a bug in our extension we're fixing. But if you're getting a block on one specific file when you try to download it, it could be a malicious file. The URL's your provided don't really help, but a screenshot of what you're seeing could.

Well that is a relief. My machine has been running smooth as butter and I was under the impression it was clean as a whistle.  From what you say it probably still is.

 It is never a single file but always multiple tabs.  Next time it happens I will grab a screen shot

[Andrzej1]

On 11/3/2018 at 7:56 PM, dcollins said:

 The URL's your provided don't really help, but a screenshot of what you're seeing could.

I've been out of town for a couple of days and I haven't used my desktop computer since Saturday.  The first file I attempted to download upon returning just now was from Overdrive and immediately four tabs were open by what I now assume is Malwarebytes.  As requested please find attached a screen shot of the event.

[dcollins]

Thanks for confirming. This is a bug we are actually hoping to have resolved very soon. You can safely ignore those errors for the time being.

[ramseyjack]

Thanks... I am seeing the exact same behavior..

[Andrzej1]

3 hours ago, ramseyjack said:

Thanks... I am seeing the exact same behavior..

You're welcome!