Is VirusScanner safe?

Medium risk

VirusScanner reports every URL you visit and every file you download to third-party servers, tagged with a persistent tracking ID.

On every tab navigation, the extension sends the full URL to a Logz.io logging endpoint alongside a random ID it generates on install and syncs across your signed-in Chrome instances. On every download, it separately sends the filename and source URL to searchfluxy.com and shows a "virus scan passed/failed" notification, even though it never reads or scans the downloaded file's actual content. It also forces every new tab and browser startup to open searchfluxy.com instead of its own new-tab page.

ScanSoftwaresv1.3.1Chrome Web Store
53Risk
Who publishes it

Wurk - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ScanSoftwares
Declared legal entity
Wurk
Registered address
2162 Market St, San Francisco, CA 94114-1319, US
Registered contact
Wurk
Website
filescannerplus.com/

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

listener.logz.io
Also called by 4 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

VirusScanner reports every site you visit to a third-party log server

Code analysis shows the extension tags your browser with a persistent ID, then sends the full URL of every page you visit to a third-party logging service on every tab navigation, with no site scoping.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open or switch to any website in any tab.

No content script runs on the page; the extension watches tab navigation from the background instead.

The extension did this

The extension sends the full URL you just navigated to, along with a persistent ID for your browser, to a third-party log ingestion service.

This fires on every navigation to every site, not just sites related to the extension's stated virus-scanning purpose.

Fields sent in the navigation log request
  • Page you navigated to
    https://www.example.com/checkout?order=48213

    The complete URL of the page you just opened, including path and query string.

  • Your persistent ID
    a1b3f209e7c4...

    A random ID generated once at install and reused for every log entry, letting the destination tie all your visited URLs to one profile.

  • Event name
    Search

    Labels the log entry as a navigation event.

The code that does this

The navigation listener and log sender

Readable version

Navigation listener (readable)

background.js
chrome.tabs.onUpdated.addListener(function (tabId, changeInfo, tab) {  if (changeInfo.url) {    if (urlIdentifier.getUserID != null) {      if (urlIdentifier.isConfigured()) {        if (analytics == null) {          analytics = new Analytics(urlIdentifier.getUserID());        }        analytics.sendLog("Search", changeInfo.url);        if (urlIdentifier.isTimePassed()) {          urlIdentifier.identifyUrl(changeInfo);        }      }    }  }});

Log sender (readable)

background.js
class Analytics {  constructor(userid) {    this.LOGS_DOMAIN = "https://listener.logz.io:8071/?token=LmwCnDZFmAjheCLYJijdBTtywcSZQpnh&type=extention";    this.userid = userid;  }  sendLog(logtype, logdata) {    fetch(this.LOGS_DOMAIN, {      method: "POST",      mode: "no-cors",      headers: { "Content-Type": "application/json" },      body: JSON.stringify({        script: "extention",        client_id: this.userid,        event: { name: logtype, params: { id: logdata } }      })    });  }}
Where the navigation data goes
    • listener.logz.io

    Receives every visited URL tagged with your persistent client ID, on a hardcoded ingestion token embedded in the extension's source code.

    • searchfluxy.com

    Receives the persistent ID at install time and serves the remote config that gates parts of the extension's behavior.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

VirusScanner shows a fake pass/fail scan result for every download

Code analysis shows the extension sends each download's filename and source URL to a third-party server, then shows a 'Virus scan' pass or fail notification based on that response, without reading the file's contents.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You download any file, from any site, while the extension is installed.

The listener fires for every download regardless of file type or source.

The extension did this

The extension sends the download's filename and source URL to a third-party server, then shows a notification claiming the file passed or failed a virus scan.

The file's own bytes are never read, hashed, or uploaded, so no content-level scan of the file is possible from this request.

Fields sent for each download
  • Downloaded file's name
    Q3_bank_statement.pdf

    The filename of whatever you just downloaded, which can reveal document titles, invoice numbers, or personal file-naming patterns.

  • Download source URL
    https://mail.example.com/attachments/48213

    The page or direct link the file was downloaded from.

The code that does this

File-metadata upload and the notification it drives

Readable version

identifyFile (readable)

background.js
async identifyFile(filename, url) {  try {    const request = await fetch(this.DEFAULT_DOMAIN + "/identifile", {      method: "POST",      body: { filename: filename, url: url }    });    const isOk = await request.json();    return isOk.validated;  } catch (error) {    return false;  }}

Download listener and notification (readable)

background.js
chrome.downloads.onCreated.addListener((downloadItem) => {  urlIdentifier.identifyFile(downloadItem.filename, downloadItem.url)    .then((result) => {      if (result.validated == true) {        chrome.notifications.create({          type: "basic",          iconUrl: "./images/icon16.png",          title: "Download Protection",          message: "A new file has been downloaded and successfully passed our Virus scan."        });      } else {        chrome.notifications.create({          type: "basic",          iconUrl: "./images/icon16.png",          title: "Download Protection",          message: "A new file has been downloaded and failed our Virus scan."        });      }    });});
Where download metadata goes
    • searchfluxy.com

    Receives the filename and source URL of every download and returns the pass/fail flag the notification displays, with no file-content scanning behind it.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.3.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on ec2-18-185-21-72.eu-central-1.compute.amazonaws.com

    http://ec2-18-185-21-72.eu-central-1.compute.amazonaws.com/*

  • Read and change your data on listener.logz.io

    https://listener.logz.io/*

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • Show you desktop notifications

    notifications

  • Schedule its own background tasks

    alarms

Where it sends data

Destinations our analysis observed VirusScanner contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • listener.logz.io

    VirusScanner sends data to listener.logz.io. No other extension we have analyzed sends data here.

  • searchfluxy.com

    VirusScanner sends data to searchfluxy.com. No other extension we have analyzed sends data here.

Updated 30 September 2026nlibiflmdbdfgngohdpncflaofeokcnd