Infected Web Resource - Help

[stevejh]

Hi all.

I use Bitdefender as my antivirus and it keeps tellng me that it's blocked a web threat from 'infected web resource storage.googleapis.com/update ..........'.

I know it's blocked it but there's loads of messages saying the same or similar. When I've googled it I just keep getting sites dubious spyware removal programs.

1. Should I be worried about this?
2. Is there anything I can do to get rid of this 'threat'?

Any help would be much appreciated.

[mmm-five]

Can't tell what it is as you've only supplied the top-level location, but it could be a plug-in for a wordpress website that's been hacked and not been patched...or it could be a false positive.

Not enough info to be sure though.

[stevejh]

mmm-five said:

Can't tell what it is as you've only supplied the top-level location, but it could be a plug-in for a wordpress website that's been hacked and not been patched...or it could be a false positive.

Not enough info to be sure though.

The full wording is - storage.googleapis.com/update-delta/hfnkpimlhhgieaddgfemijofmfblmnib/5825/5824/dbdf4a228dad5b04a8d7137464966276391e789d87fbf26da81b98d0f25ddc1.crxd

[mmm-five]

That looks like one of your Chrome extensions is trying to auto-update itself.

What Chrome extensions are you running, and can you do a manual update (or manual download to update)?

Could still be a false-positive if someone has reported something similar to BitDefender, not realising what it actually was.

[stevejh]

I actually run Brave and Chrome and because I've just reset Windows I only have lastpass as an extension on Brave which is my default browser but I do have quite a few extensions on Chrome but they have been on it for years with no issues.

[stevejh]

I disabled some of the more obscure extensions I had on Chrome and it seems to have stopped the Infected Web Resource warnings from Bitdefender so it looks like it was one of the extensions that was the culprit.

Thanks for your help. I wouldn't have thought of browser extensions as being the problem if you hadn't mentioned it.

[mmm-five]

No problem.

That's why the full string was required, as it was saying something 'dodgy' was stored on a googleapi server, but we couldn't tell what.

The rest of the message showed it was a delta update to a file with a .crxd file extension...i.e. a chrome extension.