Spam on chrome through Arbtalk

[Brett]

just happened to me for the first time,

on google chrome.

[peatff]

http://13989x3422100-9853x310-virus.com/en/?id=MDgwMCAwNDggODg2Ng. Try this on Chrome, it's in my history from somewhere.

[NFG]

OK,

 

Assuming this is a Chrome exploit/issue, as try as I may I can't seem to get it to appear.

 

So has anyone tried something to control scripts in Chrome? - similar to NoScript as previously posted, such as:

 

UBlock origin: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm

 

ScriptSafe: https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf

 

I know UBlock is very good & it would make general web browsing more secure

 

 

N

[Brett]

seriously..... i just clicked on that ublock link and it popped up.

[NFG]

seriously..... i just clicked on that ublock link and it popped up.

 

Odd, as the UBlock link is Googles own,

 

sure you are squeaky clean?

 

what AV & Malware progs do you use, just out of interest?

 

I take it you have chrome pop-up setting set to Block ?

 

Is it always the same URL in the pop-up ? as that should be easy to defeat.

 

& is your version of Chrome up to date

Edited May 8, 2017 by NFG

[NFG]

OK,

 

This is an inspired guess, I think people who experience this problem may have installed a Chrome add on which has a vulnerability or is a PUA (unwanted aplication)

 

So, is there a way to manage add ons in Chrome? If so then some experimenting with disabling add ons & browsing as its not just Abrtalk it affects people browsing Amazon and other sites.

 

Also a scan with MalwareBytes would be beneficial as that detects PUAs as does Googles own tool

 

https://support.google.com/chrome/answer/6086368?hl=en&vid=0-1227583814471-1494256397041

 

Please post back any one who finds anything

[NFG]

OK,

 

After a bit of search Im fairly sure the cause is Chrome extensions, so

 

1. Click the wrench at the top right of the browser.

2. Select settings

3. Click on extentions either disable all or disable individually until you find the one causing the problem.

 

If some one could post back

 

 

N

[john k]

OK,

 

 

 

After a bit of search Im fairly sure the cause is Chrome extensions

 

 

It doesn't appear to be browser specific. I had it happen on Firefox, and people have reported it with a number of other browsers.

Edited May 9, 2017 by john k

[john k]

so paretologic replied to my email saying they could not replicate the flag that im receiving....yet when I run the test again now it says they are listing it as a clean site...

 

https://virustotal.com/en/url/0afd09927d1e80e64b2c3a7e72b95dd82aadbd9025a4049c2afeaeeb3d4ba897/analysis/1490303004/

 

could someone confirm if they are still getting the error message please?

 

That link is just to a single file (this thread). If you run it for the whole site it still comes up with the warning:

 

https://virustotal.com/en/url/d0a522331409c51867e0d0ec447fbf8bfc67eff91074a3a287a1fe3961b61bb7/analysis/1494369001/

[NFG]

OK,

 

Thanks John K

 

So it looks like we are looking for a cript injection as opposed to browser extension,

 

3rd party adverts perhaps?