I just discovered my browser had been hijacked!

[thewayne]

I've noticed that I've had slightly odd behavior for a couple of weeks: I'd type in the url for a site that I've visited before, and I'd get a message saying that access to that site had been blocked by an add-in!

Very odd.

Tonight, I was looking for some Grateful Dead midi files. Open up Google, type in 'Grateful Dead midi file' and hit enter. And I happened to notice that the tab bar said MaxAsk.com! Now, the interesting thing is that the results looked fairly reasonable, and had the Google logo, but that's easy enough to impersonate.

Doing a little digging in a different, very rarely used browser, revealed that MaxAsk is a browser hijacker! This could explain trouble accessing web sites. I checked the add-ins that I had which were rather few: an ad blocker, and one that I didn't remember loading. I removed it, and Google seemed to be responding normally.

Very weird. And, of course, the big question is: how did it get installed!

I'm going to have to do some cleaning and see if there are any traces of any other problems lurking on this box.

Comments

[darkoshi]

If you have your browser history being saved, you could check for the first instance of MaxAsk.com in the history, and check what pages you opened before that which might have installed it. Maybe you installed something else around that time which included it.

Firefox's history view only lists the most recent time each page was opened. I use this Nirsoft tool to list my full browsing history including multiple visits to the same pages in the actual order I visited them, from all my browsers (it works for many besides Firefox):
https://www.nirsoft.net/utils/browsing_history_view.html

[thewayne]

The cookie for MaxAsk was dated mid-September, my browsing history didn't go that far back unfortunately.  It's pretty rare that I install stuff on this PC, it's pretty static.  I'm working on blocking that site through my firewall and router.