- Jul 11, 2014
- 2
I don't know how long the extension has been on the list, but as of yesterday chrome keeps notifying me about developer extensions being on use every time i open the browser. Whether i click on the disable or close button the Sauve, on extension reappears at the top of the list even after i've deleted it before.
This might be nothing, but at the time when i found out about the extension and tried to delete it i got a popup that gave me a 671kb file named download(I didn't run it). It has 10 lines of js, i don't know js syntax but some of the commands sound very suspicious. the entirety of the file ran in notepad++ is:
This might be nothing, but at the time when i found out about the extension and tried to delete it i got a popup that gave me a 671kb file named download(I didn't run it). It has 10 lines of js, i don't know js syntax but some of the commands sound very suspicious. the entirety of the file ran in notepad++ is:
Code:
<!DOCTYPE html>
<html>
<body onload="window.location.href='[URL='http://omptrendo.s3-website-eu-west-1.amazonaws.com/index2.html?__ipu=1'][COLOR=#ffffff]http://omptrendo.s3-website-eu-west-1.amazonaws.com/index2.html?__ipu=1[/COLOR][/URL]'">
<script type="text/javascript">
var ua = '';
if(ua.match(/^UA\-\d{4,10}(\-\d{1,4})?$/))
{
var _gaq = _gaq || [];
_gaq.push(['_setAccount', ua]);
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? '[URL='https://ssl'][COLOR=#ffffff]https://ssl[/COLOR][/URL]' : '[URL='http://www'][COLOR=#ffffff]http://www[/COLOR][/URL]') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
}
</script>
</body>
</html>
Last edited by a moderator:
