Do I have malware SOLVED

Hi Guys

Recently I’ve notice strange behaviour in my web browser (Chromium), every so often a pop up will appear telling me I’ve won an Ipad, then when I close the box I’m led to a webpage prompting me to update flash player which i know is bogus so I just close the page and all seems well, but this evening I noticed that some text on a post I had posted this morning has been hyperlinked, so far the hyperlinks are only on the original post, but I have no idea how they got there.

Any ideas ?

Many thanks


More inclined to think you’ve visited an iffy site. Solution; make sure you set chrome to start clean rather than restoring previous tabs, then quit chrome and restart. Make sure chrome itself actually quits completely. ( then see if it still happens )

You need to pay attention to the site you are on when you see this … But it sounds like the a site you’re visiting is actually the problem …

Sent from my Nexus 4 using Tapatalk 2

HI Mad Penguin

Thanks for your help

I have no idea what iffy site I could have been on, this is a laptop that I’m on very rarely, and the sites I’m mainly on is this site, and some other Linux forums, ebay and general browsing, I am never on porn sites if that’s what you mean by iffy. I’ve noticed even on your reply one word is hyperlinked, my settings are set for “open homepage” and I always close by clicking the X in the top right corner.

I have not used Chrome for some time (OK tried it for couple of months beginning of last year) but is there not a setting to clear all browsing history, cookies and the like.
Also to watch out for flash cookies as they are perennial. For this I use BetterPrivacy addon (in Firefox).
You can also delete these super cookies on the Adobe website

Hi Sezo
Thanks for your advice, I have already cleared all my browser cache but the problem actually seems to be getting worse as time goes on I’ve attached some screen shots to let you see what’s happening

The first screen will suddenly pop up randomly, so I close out then led to the second screenshot prompting me to update flash player, I know this is bogus because I’m sure I tried it and it led me to some 3rd party site but I can’t remember exactly, the third screenshot is what I get now browsing threads on this site, that and the hyperlinks I’ve only noticed this evening


Just another example here’s a screenshot, of a hidden page I find when closing down Chromium

Many thanks


Have you got any plugins installed ?

Click this links and see what’s listed:

OK, It looks like that the pages get locally modified by a plugin (some driveby exploit must have loaded it at some point).
Look what plugins you have running. If you can identify which is causing the problem then remove it and restart the browser.

If you cannot then more drastic action is needed. Look in your home folder for the (hidden) .Chromium folder and rename it.
Then start Chromium again, see if that clears the issue. If that works then you can restore your bookmarks from the original (renamed) folder.

It appears that folder is ~/.config/chromium/Default not .Chromium :cry:

I have a few plugins installed to many to type so I’ve attached another screenshot of the Extensions page, It’s getting late and i’m off to bed now but I’ll act on any advice in the morning

Many thanks


Disable ALL your plugins then restart Chromium and see if the problem disappears … if it does, enable them one at a time (restarting Chromium each time) to discover which is the problem one … then remove it.

There seems to be no problematic extension listed on that screenshot, but you could try to disable them all (as Mark said) and restart the browser.
Alternatively you could (just for test) rename the following folders:
These will be re-created clean on the next visiting a flash site and startup of the browser

Hi Guys

Thats it sorted, the offending plugin was SaveAs 2.4, To be honest I don’t know what it does or even remember installing it, but disabling it sorted it immediately.

Many thanks


Interesting, I thought Google’s management / censorship of extensions was better than that (!)