Malware attached to Chrome. Virus scan finds no problem

Norton 360 for Windows
1

Chrome sometimes opens a webpage that I did not request. It opens it in a new tab.

Detailed description: The new tab usually, but not always, is for search_DOT_yahoo_DOT_com. The search topic is sometimes related to something I recently searched with Google search. (I NEVER use yahoo for ANYTHING!) The Malware is even getting data from the Search box in the Google Calendar. For example, “NE 22” in the Calendar search box (“NE22” is an abbreviation that I use in my exercise calendar) resulted in a new tab for search_DOT_yahoo_DOT_com for topics related to Nebraska! When I put “chicken casserole” in the search box, the new tab went to a cooking website directly without showing search_DOT_yahoo_DOT_com.

In addition to firing from the Search box of the Google Calendar webpage, it also happens on random links and button clicks. Note that what it is displaying are NOT pop-up ads but full webpages opened in a new tab. I use AdBlockPlus, which does block pop-ups, but does not block these unwanted web pages in new tabs.

Sometimes when the new tab with the unwanted web page appears, the desired web page does not appear until I go back to the correct tab and click on the link or button again. Other times it seems that the desired webpage loads first (in the correct, current tab) followed by the undesired web page loading in a new tab. In either case, the new tab, the one with the undesired web page, ends up having focus. I therefore need both to close the new tab and also return focus to the tab I was actually using.

Note that this happens only with Chrome, not with other browsers. The screen shot uploaded shows that the Google Calendar Search box is NOT the Google Search box. It does not search the web, but just the contents of my Google calendars. “Chicken casserole” correctly showed a result of “Not found” in the current tab, but also created a new tab for the cooking website.

Product & version number:Norton 360 26.9.11171.2699. Google Chrome 155.0.8059.40

OS details: Edition Windows 11 Pro. Version 26H2. Installed on 10/‎25/‎2024. OS build 26300.9711. Experience Windows Feature Experience Pack 1000.26100.372.0.

What is the error message you are seeing?

If you have any supporting screenshots, please add them:

Screen shot for Norton
Screen shot for Norton899×866 137 KB

2

@Al_Bear There is some AI generated information that may be of help. Please note that AI can make mistakes so please verify suggestions as needed:

AI Overview

If you are seeing random, unfamiliar entries pop up in your Google Calendar search history or on your main layout when using Google Chrome, you are dealing with a known “ghost spam” glitch or a calendar phishing tactic. [1, 2]

Scammers exploit Google Calendar’s automatic settings to inject fake events (like “Invoice Due” or “Crypto Prize”) into your schedule, which then corrupts your search bar history. In other cases, it is a known Google search cache bug. [1, 2, 3]

Follow these steps immediately to clean up your history and lock down your calendar:

  1. Fix Your Google Calendar Settings

Preventing future automated spam injections requires a change to your invite permissions:

  1. Open the Google Calendar desktop site in Chrome. [1]

  2. Click the Gear icon in the top right and select Settings. [1]

  3. On the left menu, click Event settings. [1]

  4. Look for Add invitations to my calendar and change the dropdown from “From everyone” to “Only if the sender is known” (or “When I respond to the invitation in email”). [1, 2]

  5. On the left menu, click Events from Gmail and uncheck the box for “Automatically add events from Gmail to my calendar”. [1, 2]

  6. Remove the “Ghost” Search Results

If you have spam terms stuck in your Calendar search bar that you can’t click on or delete: [1]

  • Report the original event: If the fake search stems from an active event, find it on your calendar layout, click the three vertical dots, and choose Report as spam. This nukes the whole chain. [1]
  • The Shared Calendar Fix: A known bug sometimes leaves “ghost” text in the search bar that cannot be opened or deleted. Product Experts note the most reliable workaround is to share that specific calendar with a backup Google account (giving it full “make changes and manage sharing” permissions). Log into that second account, look at the calendar, and you will be able to see and permanently delete the hidden spam event triggering the search result. [1]
  1. Clean Chrome’s Cache & Permissions

Sometimes malicious websites push rogue script notifications or predictive search text into Chrome: [1, 2]

  1. In Chrome, click the three dots (top right) > Settings.

  2. Go to Privacy and security > Clear browsing data. Clear your Cached images and files and Browsing history.

  3. Go to Privacy and security > Site settings > Notifications. Look at the “Allowed to send notifications” list and remove any strange or unrecognized URLs. [1, 2]

SA