Can you help me unconfuse Chrome?
January 12, 2017 12:35 PM   Subscribe

Since yesterday afternoon, if I go to amazon.com, I end up at https://valao.de/goto/amazon-deals.php This only happens in Chrome, on both my work and home computer. I've cleared cached, and run malwarebytes, and checked chrome extension. Malwarebytes found nothing. The only thing I've installed yesterday was Citrix Receiver, which I need for work. This doesn't happen in Firefox. What else can I do to solve this?
posted by korej to Technology (16 answers total) 4 users marked this as a favorite
 
Go to Settings. There should be a search box, type in proxy. Select the Change proxy settings. Select LAN settings. If the Use a proxy server option is checked, uncheck it.
posted by Apoch at 12:39 PM on January 12, 2017


If you are running Windows, there's a Chrome Cleanup Tool.
posted by clearlydemon at 12:49 PM on January 12, 2017 [1 favorite]


You could check chromes plugins too, if changing the proxy doesn't work. "chrome://plugins" in the address bar, pdf, native client, flash & widevine are the normal ones, i would research any others listed there and disable them if fishy.
posted by TheAdamist at 12:54 PM on January 12, 2017


Use a proxy servier is not checked in LAN settings. (to be clear, you mean in Windows> Internet properties> Connections?) And Chrome Clean Up Tool says No Programs Found. The only plugins are Widevine, native client, Flash and Chrome pdf viewer.
posted by korej at 12:58 PM on January 12, 2017


Does the same thing happen if you use an incognito window?
posted by shponglespore at 1:20 PM on January 12, 2017


Right-click in the address bar and check Edit Search Engines to see if Valeo shows up there.

Also, check the proxy settings in Internet Explorer. I worked a job where we had a proxy for the Internet, and the settings would show up in IE and not in Chrome, even though Chrome worked fine for Internet purposes.
posted by possibilityleft at 1:22 PM on January 12, 2017


It does *not* happen when I'm in an incognito window. A clue!
Right clicked in the search bar, its not in the search engine list. And I'm not seeing anything in proxy checking it from IE, either.
posted by korej at 1:31 PM on January 12, 2017


I was going to suggest your home router might be compromised, but Is your work computer at work? And your home computer at home? So they would be on different networks unless you are vpn'd in.

What else is in common between your work & home computer?
posted by TheAdamist at 1:47 PM on January 12, 2017


Work computer is at work, home is at home. They're on separate networks. They both use windows. However, I just checked my chromebook, and it also redirects to that address when I type in amazon.com. I think it must be a setting in Chrome, but I can't seem to find it.
posted by korej at 2:04 PM on January 12, 2017


Disable your extensions one by one.

ctrl+shift+i

That brings up Chrome Developer Tools. Then Go to the network panel in Developer Tools, set it to Preserve Log and see what happens.
posted by idb at 2:09 PM on January 12, 2017


will start disabling extensions now. When I have the preserve log open, it caught a number of things. Unfortunately, I don't know what to make of them. I've taken a screenshot - here: https://snag.gy/f8nGBe.jpg
posted by korej at 2:17 PM on January 12, 2017


Ok - this is very odd. There's a hex color code plugin I've had forever, and disabling that seems to make the problem go away. And, on looking at it in the chrome store, looks like its made by the same valao.de folks. https://chrome.google.com/webstore/detail/hex-color-code/ Thank you for having me disable them one by one - I guess I was only looking for new things in extensions!
posted by korej at 2:26 PM on January 12, 2017 [3 favorites]


Did you sync your work and home computers? Do you log in to the same google accounts at work and at home?
posted by Obscure Reference at 2:41 PM on January 12, 2017


I know I've heard that sometimes existing extensions get bought by people who put in malware into automatic updates. So the extension may have been fine until now, but is now scammy!
posted by wyzewoman at 2:46 PM on January 12, 2017 [4 favorites]


It is the same google account at work and home - and I think someone purchasing the extension is what must have happened. Thank you all so much for digging through this with me!
posted by korej at 2:56 PM on January 12, 2017


If by chance you're looking for a replacement color picker for your browser, try ColorZilla. I've been using it for years and it works great without any scammy redirects or ads.
posted by katyggls at 3:14 PM on January 12, 2017 [3 favorites]


« Older How do I make joint custody work?   |   Was my life as a bespectabled person a lie? Newer »
This thread is closed to new comments.