Lots of about Tamper Monkey extension tabs are been opened

[dave600b]

Only just started playing with it but seem to get lots of these tabs. No other extension I have does this.

Chome Version 59.0.3071.115

[derjanb]

What's the content of these tabs?

[dave600b]

Its opening this page a lot. https://nimpekprg.com/tampermonkey-for-chrome/

[derjanb]

You've installed a fake from the Chrome Web Store. (https://chrome.google.com/webstore/detail/tampermonkey-for-chrome/lbjhpacjceckhhojhidpnpoopbkoango)

Just go to chrome://apps and remove it and install the real Tampermonkey extension from here:
https://chrome.google.com/webstore/detail/tampermonkey/dhdgffkkebhmkfjojejmpbldmpobfkfo

You can also check this for more information: http://www.pcworld.com/article/3027642/security/googles-chrome-web-store-lists-malicious-chrome-apps-ahead-of-legit-extensions.html

[dave600b]

Sorry and thank you. Any idea what its malicious intent was / is?

[tophf]

This is the deobfuscated code:

var url = 'https://nimpekprg.com/tampermonkey-for-chrome/?{term}';
chrome.alarms.create('check-ext-exists', {
  periodInMinutes: 360
});
chrome.runtime.onInstalled.addListener(function(info) {
  if (info.reason == 'install') {
    chrome.browser.openTab({
      url: url.replace('{term}', 'first-launch')
    });
  }
});
chrome.app.runtime.onLaunched.addListener(function() {
  chrome.browser.openTab({
    url: url.replace('{term}', 'app-launcher')
  });
});
chrome.app.runtime.onRestarted.addListener(function() {
  chrome.browser.openTab({
    url: url.replace('{term}', 'app-restarted')
  });
});
chrome.alarms.onAlarm.addListener(function() {
  chrome.browser.openTab({
    url: 'https://nimpekprg.com/tampermonkey-for-chrome/'
  });
});
if (chrome.runtime.setUninstallURL) {
  chrome.runtime.setUninstallURL('https://nimpekprg.com/tampermonkey-for-chrome/');
}

It opens its site on install, as well as every 6 hours, on every launch/restart of the app, and on uninstall.

[dave600b]

Well ok then. Feel like a bit of a user now. Thanks again.

[Billsfan2]

Hey, I know that this thread probably closed a while ago but I am new to the site and not sure where else to post this. I am having the exact same issue that "dave600b" was with Tampermonkey. The only difference is the URL: http://nimpekprg.com/download-youtube-videos-as-mp4/. This is probably because I installed the "fake", then the "Download YouTube Videos as MP4's" script from OpenUserJS. I followed the simple instructions given to "dave600b" by "derjanb" but I am still getting these unwanted popups just as before. I have been able to block the IP address with "PeerBlock" but still getting them (now with 404 error). Any advice one of you all could provide would be greatly appreciated. Thanks.

[derjanb]

There now also is a malware named "Download YouTube Videos as MP4". Please remove every app at chrome://apps.

#449 (comment)

[Martii]

@Billsfan2

This is probably because I installed the "fake", then the "Download YouTube Videos as MP4's" script from OpenUserJS.

Are you saying there is a malware script on OUJS with this title (@name)? I don't seem to find the title of "Download YouTube Videos as MP4's" with an https://openuserjs.org/?q=Download+YouTube+Videos skim .

Please feel free to flag any script that you think may be malware and briefly but accurately describe how you arrived at that conclusion in the text box that pops up and it will get evaluated.

OUJS Admin

[Billsfan2]

Thanks for the replies, I may have unfairly pinned this on "OpenUserJS" because I grabbed a couple of other scripts from there. A little background; I was using Tampermonkey before to modify YouTube so that I could watch videos with FlashPlayer and download them quickly if I wanted to. The recent update to YouTube pretty much broke all the scripts I was using and I ended up uninstalling Tampermonkey to "lighten" my browser cause it was doing nothing at this point. I reinstalled it after a bit cause I really missed the download feature I used to have using either this script:

https://userscripts-mirror.org/scripts/show/25105

Or this one (Not sure which):

https://greasyfork.org/en/scripts/29570-download-youtube-videos-as-mp4

Both of the above scripts were broken with YouTube update.

THIS one has the exact same name as the above two and you kind of get directed to it after installing the fake:

https://chrome.google.com/webstore/detail/download-youtube-videos-a/gpgiicjolkojklcghkmbbhpeofghedce?hl=en

Looking at the comments on the 3rd one users are complaining of the exact same symptom that I am. The mystery is solved..I had uninstalled the fake Tampermonkey but forgot that this extension was still on my browser! Sorry to be so dumb, and thanks derjanb and Martii for your responses.
BTW: THIS script below actually still works for YouTube downloading, not as neat as those other two that I mentioned but better than nothing:

https://openuserjs.org/scripts/aidask/Download_YouTube