noticed today this process running on google chrome task manager referencing http://shelljacket.us
If I closed it will restart automatically in a few seconds.
Can anyone confirm if this is safe? How can I get rid of it?
noticed today this process running on google chrome task manager referencing http://shelljacket.us
If I closed it will restart automatically in a few seconds.
Can anyone confirm if this is safe? How can I get rid of it?
Your Task Manager is showing "Subestrutura: http://shelljacket.us
. This is Portuguese for "Subframe: http://shelljacket.us
", and means that Site isolation is enabled in your Chrome browser. Google's help page on this feature suggests that you can toggle Site isolation via chrome://flags/#enable-site-per-process
Even when you did not enable site isolation, then site isolation will still be used for websites loaded inside a Chrome extension. In your process list, I see that the item immediately above your unwanted process is an extension. To get rid of the frame, you can try to disable the extension.
Seeing an unknown site in a separate process in itself is not something to worry about. But this site in question seems to only contain a tracker from QuantCast, which I consider suspicious from the privacy perspective.
I looked up the extension in the Chrome Web Store ("Hotspot Shield Elite VPN Proxy") and used my Extension Source Viewer to read the source code of the extension. I found a code snippet in the extension's background script that confirms that the extension is embedding an frame with a QuantCast URL.
}, {
key: 'quantcast',
value: function quantcast() {
if (!sdk.config.reporting.quantcast) return;
var iFrame = document.createElement("IFRAME");
iFrame.setAttribute("src", sdk.config.reporting.quantcast.url + '?rand=' + Date.now());
iFrame.style.width = 0 + "px";
iFrame.style.height = 0 + "px";
iFrame.style.display = "none";
document.body.appendChild(iFrame);
}
}, {
If you are using that VPN extension for privacy purposes, I would recommend you to immediately uninstall it, because this is clearly a sign that your privacy is violated.