YTD Downloader malware

Question

Level 1

0 points

YTD Downloader malware

I downloaded a program called "YTD" off CNET to download videos from youtube. The program worked great, but I think it left behind some malware. All I've noticed is that it changed the search preference of all of my browsers to Yahoo, and it installed some add ons in the toolbar (ebay, amazon, etc.). Another weird thing I noticed is some text in the URL when I open a blank new tab. It used to remain blank but now a new tab opens with this typed out in the bar: "chrome-extension://icdlfehblmklkikfigmjhbmmpmkmpooj/newtab.html"

It's starting to really annoy me. What can I do to get rid of this? I already did a full scan with avast and nothing was found.

MacBook

Posted on Mar 16, 2014 11:48 PM

Reply

Answer 1

rev808

Level 1

0 points

Mar 27, 2014 10:12 AM in response to dekay2

I just did the same thing with YTD and got the same "chrome-extension://icdlfehblmklkikfigmjhbmmpmkmpooj/newtab.html" on my new tabs. ANNOYING. I deleted YTD but still had the problem.

Solution was found when looking in the Extensions page for Chrome. I thought originally that deleting the YTD would delete any extensions but I was wrong. there were FIVE that YTD had installed for me. I deleted all the following and now my new tabs are clear 🙂

search me
slick savings
rss subscriptions extension
ebay shopping assistant
amazon shopping assistant by spigot

Reply

Answer 2

Eric Root

Level 10

684,033 points

Mar 27, 2014 10:37 AM in response to dekay2

Don't download things from CNET. It appears they are bundling other software/malware with their downloads.

Reply

Answer 3

lytic

Level 1

5 points

Mar 28, 2014 6:04 AM in response to rev808

It is Adware.Spigot.1. Additionaly to install http://www.youtubedownloadersite.com/installers/YTDMac.dmg it change home page and search engine to:

hxxp://search.yahoo.com/?fr=spigot-yhp-sfmac
hxxp://search.yahoo.com/?fr=spigot-yhp-gcmac
hxxp://search.yahoo.com/search?fr=spigot-chr-gcmac&ei=utf-8&ilc=12

and install extensions:

coupons.crx
ErrorAssistant.crx
saamazon.crx
saebay.crx
Searchme.chromeextension.crx
Amazon Shopping Assistant.safariextz
Ebay Shopping Assistant.safariextz
Searchme.safariextz
SlickSavings.safariextz
coupons.mybrowserbar.com.xpi
saamazon.mybrowserbar.com.xpi
saebay.mybrowserbar.com.xpi
searchme.mybrowserbar.com.xpi

Reply

Answer 4

uzi73mm

Level 1

4 points

Jul 11, 2014 6:15 AM in response to dekay2

Also, in Chrome the CNET installed Malware will place an extension for new tabs to yahoo.... To remove, in chrome right click on the upper right corner for settings, then tools, then extension and remove all that you know is malware, restart chrome...

Reply

Answer 5

Oct 19, 2014 3:41 AM in response to dekay2

There is an easy way to get rid of it. Settings --> Extensions --> Remove all the ones you don't know, one of them is bound to be the annoying thing. Worked for me a minute ago. Hope this helps.

Reply