Author Topic: Chrome search hijack not detected by Avast  (Read 537 times)

0 Members and 1 Guest are viewing this topic.

Offline avast21

  • Newbie
  • *
  • Posts: 2
Chrome search hijack not detected by Avast
« on: July 23, 2022, 07:41:40 PM »
My Google search in Chrome on Windows 10 got hijacked with pulpysearch.  Any query redirected to pulpysearch.com and finally to bing.

Scans with Avast and Malawarebytes found nothing wrong.

Chrome settings showed nothing wrong in the search engines.  No extensions loaded.

Clean install of Chrome cured it .. until i signed into Google at which point the hijack reappeared.

Clearing Appdata/Local/Google/Chrome/User Data fixed it ... until Google synch ran and the problem returned.

It seems that the replication was bringing the hijack into the /Default/Syncdata/LevelDB

Avast deep scan still saying nothing found.

With a bit of tinkering, I turned off Sync of Settings ... that seems to where the hijack was hiding ... Then cleared my Google data and the infection hasn't returned.

Why does Avast not find and clear this hijack?

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37147
  • Not a avast user
Re: Chrome search hijack not detected by Avast
« Reply #1 on: July 24, 2022, 01:33:02 AM »
Quote
Why does Avast not find and clear this hijack?
Is PUP detection ON ?




Offline avast21

  • Newbie
  • *
  • Posts: 2
Re: Chrome search hijack not detected by Avast
« Reply #2 on: July 24, 2022, 12:00:45 PM »
Default settings on File Shield and Web Shield.

I've had other PUP show up in Quick Scan and Deep Scan before.   This one didn't.

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 33519
  • malware fighter
Re: Chrome search hijack not detected by Avast
« Reply #3 on: July 24, 2022, 02:30:03 PM »
This stresses the importance of having a decent ad- and script-blocker inside the browser.
uBlock origin and uMatrix for instance.

Be aware, some online removal schemes are from malicious/suspicious sources as such.
Use Google Safe Browsing and stay away from suspicious or malicious extensions.
Visiting or downloading from suspicious websites/sources may infest you.

polonus
« Last Edit: July 24, 2022, 03:38:11 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!