13

I notice when I start up Google Chrome it makes a few bad requests to random host names, such as mdioussrvd, azwvtdbpjh, and lblhkhlklj.

Picture.png

I'm wondering what is causing this and/or what the purpose is. At first I thought I had a malicious extension, but I deleted my ~/Library/Application Support/Google/Chrome folder, deleted Google Chrome, restarted the system, then re-downloaded a clean copy of the latest beta, followed by starting the application using open -n -a 'Google Chrome.app' --args --disable-extensions, only to find the same behavior with a fresh install.

The host names are random string each time the program starts. I don't have anything in my hosts file so they are showing erros, as they are not mapped to any particular IP.

I also tried running a file search with grep in both the Google Chrome.app folder as well as the Application Support/Google folder.

It doesn't matter what the homepage is set to when I start the application. It can be set as the recent tabs page or a web address somewhere. I have to be honest, this is bugging me a little. Does anyone have any thoughts on what tools to use to figure this out?

If you want to see if your install of Google Chrome is doing this, try Charles Web Proxy. It's what I'm using - a great debugging tool and, 8mb in size.

update

Same thing happens on Windows XP with the latest (non beta) version of Google Chrome. The homepage is set to the tabs page, no extensions are installed, and all I do is start the browser. The results:

Picture.png

And here is Chromium on Mac OS X 10.6.7 with no homepage:

Picture 1.png

Can somebody who develops with the Chromium Projects explain this please?

note

I also see a vote to close this - why? I'm trying to trace / debug this and I believe it is relavant to software development and programming. Furthermore if I'm correct this affects a large number of people and warrants an answer.

12
  • Just to confirm this doesn't happen to me - I think you were right in thinking this was something malicious. Sep 18, 2011 at 21:45
  • Thanks. I don't have another system to try it on.
    – cwd
    Sep 18, 2011 at 21:47
  • I believe it is malware hijacking browsers. Otherwise maybe google chrome visits those urls to see if it's connected to the Internet or not
    – apscience
    Sep 18, 2011 at 21:59
  • 14
    A variety of ISPs have systems setup to capture and redirect typo'd domains (e.g. exmaple.com instead of example.com), so Chrome checks three random URLs on startup to determine what your ISP does with nonexistent domains. See code.google.com/p/chromium/issues/detail?id=55913 for details.
    – Mike West
    Sep 19, 2011 at 9:24
  • 3
    @Mike West has posted more about this: mikewest.org/2012/02/…
    – eapen
    Feb 20, 2012 at 7:10

0

Browse other questions tagged or ask your own question.