Hacker News new | past | comments | ask | show | jobs | submit login

Not at all surprising that the worst two extensions by a long way are both from Avira.

Yesterday I opened Chrome and received a warning that the Avira extension had been installed.

I certainly did not install it willingly. I'm pretty sure I didn't install any other software that sneakily bundled it recently, either - I mean, I'm 99.9% sure that I haven't installed _any_ software in the past week. So how why did it suddenly show up? I reported it to Chrome from the web extensions store. Highly unlikely that they'll do anything about it though.




> So how why did it suddenly show up?

If Avira has a pay-per-install program, I would say it's pretty likely that you're part of a botnet.


Interesting.

I ran every kind of virus test I could find about a month ago since I was getting weird display/jank issues. Couldn't find anything, and in the end I tracked the issues down to a windows display scaling error.

Any idea how I would go about testing for a botnet?


I've seen resetting Chrome fix all sorts of weirdness:

https://support.google.com/chrome/answer/3296214?hl=en


Resetting chrome isn't much of a solution if the underlying problem is botnet affiliation (trojan, rootkit, etc). Should be reasonably easy to shut down all applications and services, and inspect the traffic going through the router for suspicious domains. If you only have a windows machine connected there should only be Microsoft traffic and maybe the router manufacturer. Anything else, and it's probably malicious.


Inspecting your PC's traffic from a sniffer on your PC to find a rootkit seems like a fool's errand.

If something has driver / kernel level privileges it can trivially hide such traffic from any sniffer you have running.


Yes, that's why I said to inspect the router's traffic




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: