browser opens many blank tabs pointing to http://post.kareeza.com/

Avast Mac Security
1

Over the past few weeks it’s happened maybe a dozen times. I find a few extra tabs open in whatever browser I’m using all pointed to http://post.kareeza.com/… with some long URL string after that.

Here are some of the sample URLs:

http://post.kareeza.com/2/3.1.4/hv68/3fd0f04846554eb42401be22/postback_ifr?pp=2254470&ac=7972223&si=1331458&pc=105686929&pi=278457538&cr=57702544&ci=hv68&oz_tc=n0h1lFCFf9i0QlNvczWaLnEX3ttzCmF2zS2ymzkbLDAxNDAxODE3ODY0ODU0MzMzNDY-&oz_st=1399200279575&oz_v=3.1.4&oz_sc=3fd0f04846554eb42401be22&oz_xx=1&oz_df=205
http://post.kareeza.com/2/3.1.4/hv68/3fd0f04846554eb42401be22/postback_ifr?pp=2254470&ac=7972223&si=1331458&pc=105686929&pi=278457538&cr=57702544&ci=hv68&oz_tc=n0h1lFCFf9i0QlNvczWaLnEX3ttzCmF2zS2ymzkbLDAxNDAxODE3ODY0ODU0MzMzNDY-&oz_st=1399200279575&oz_v=3.1.4&oz_sc=3fd0f04846554eb42401be22&oz_xx=1&oz_df=370
http://post.kareeza.com/2/3.1.4/hv68/3fd0f04846554eb42401be22/postback_ifr?pp=2254470&ac=7972223&si=1331458&pc=105686929&pi=278457538&cr=57702544&ci=hv68&oz_tc=n0h1lFCFf9i0QlNvczWaLnEX3ttzCmF2zS2ymzkbLDAxNDAxODE3ODY0ODU0MzMzNDY-&oz_st=1399200279575&oz_v=3.1.4&oz_sc=3fd0f04846554eb42401be22&oz_xx=1&oz_df=369

I’ve seen other reports of this:

http://forums.spybot.info/showthread.php?70520-Can-t-email-returned-messages-show-an-IP-address-that-s-not-mine&p=452626

https://support.mozilla.org/en-US/questions/996457

https://discussions.apple.com/message/25609087#25609087

but no solutions or explanations.

A full avast scan is clean. No other apparent problems other than the random tabs.

Today I logged in and chrome had added maybe 20 new tabs to URLs like the ones above.

I have no other explanation for this other than malware of some sort.

2

Happened again today.
Chrome had 67 tabs pointed at this same site.

3

Have you checked the extensions you have installed? Does this happen in Safari?

4

I have about 20 extensions installed.
I’ve just removed all but the ones I use daily.
If it still happens I’ll remove the rest and see.