Also detected as:
detects and removes this threat.
The threat is an extension for Google Chrome , which redirects any searches you do on google.com, to another site, which may download malware onto your PC.
It is commonly installed by TrojanDownloader:Win32/Tracur variants.
Find out ways that malware can get on your PC.
Use the following free Microsoft software to detect and remove this threat:
You should also run a full scan. A full scan might find other, hidden malware.
You can try to uninstall the extension from within Chrome:
If that doesn't work, you can try uninstalling and re-installing Chrome from the Add or Remove Programs control panel:
You can also manually delete all of your Chrome extensions.
Caution: This will delete all of your Chrome extensions, not just the malware described on this page.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
If you’re using Windows XP, see our Windows XP end of support page.
<user folder>\Local Settings\Application Data\Google\Chrome\User Data\Default\<random>\contentscript.js
The extension appears in the Chrome Extensions menu with the name “Default Extension”
Redirects user searches
The extension redirects searches when you use google.com.
Search results are redirected to the IP address “184.108.40.206”, which may contain other malware or malicious scripts.
Analysis by Amir Fouda
Take these steps to help prevent infection on your PC.
I want to...
Note: Your feedback is very important to us, however, we do not respond to individual submissions through this channel.
If you require support, please visit the
Safety & Security Center.