MozillaZine

Hijacked by extcorp.com.xpi

User Help for Mozilla Firefox
Ling Ling
 
Posts: 10
Joined: June 17th, 2017, 9:08 pm

Post Posted June 17th, 2017, 9:12 pm

Dear Sirs,

My Firefox browser has been hijacked. It has been added the following extension:

Extension Tables 2.5 default Firefox 54.0 C:\Users\Ling\AppData\Roaming\Mozilla\Firefox\Profiles\sconsrm8.default\extensions\455574@extcorp.com.xpi

Google.com search page has been added advertising photo. Many advertising web sites have been poped up.

Please check why this extension has been added without my approval?

Best regards,
Ling

James
Moderator

User avatar
 
Posts: 26778
Joined: June 18th, 2003, 3:07 pm
Location: Made in Canada

Post Posted June 17th, 2017, 10:20 pm

Ling Ling wrote:Please check why this extension has been added without my approval?

Neither Mozilla or the Firefox web browser would add such an Extension.

This looks to be from malware. A search in search engines for @extcorp.com.xpi gives many results with random numbers before the @.

https://support.mozilla.org/en-US/kb/tr ... ed-malware

JayhawksRock

User avatar
 
Posts: 10374
Joined: October 24th, 2010, 8:51 am

Post Posted June 17th, 2017, 10:22 pm

Something here may help remove the Badware you installed... Good Luck
https://www.google.com/#q=extcorp.com
"Get your facts first, then you can distort them as you please."
~ Mark Twain

Happy112

User avatar
 
Posts: 196
Joined: April 15th, 2017, 10:25 am
Location: Never-Never-Land

Post Posted June 18th, 2017, 10:53 am

In addition to running the scans :

Go to the 3-bar menu => Addons => and look for any unfamiliar or suspicious looking extensions, like e.g.:
SafeSearch Incognito
SearchAssist Incognito
When you do find any : remove them.

(Re: 'Dear Sirs' - it's a mans', man's, man's world .......)

Brummelchen
 
Posts: 1555
Joined: March 19th, 2005, 10:51 am

Post Posted June 18th, 2017, 11:50 am

1. AdwCleaner AdwCleaner Download
Insert [Report] here, then [Cleanup]

2. Let Malwarebytes (install as free) search
Download https://www.malwarebytes.org/antimalware/
Insert logfile here
users who problaby never will get an answer from me: f*x, f*n, j*n, k*s, k*x, l*y, m*o, m*d, m*x, o*l, p*y, s*e, d*h, l*t, d*e, j*k, f*u*a

RobertJ
Moderator

User avatar
 
Posts: 9981
Joined: October 15th, 2003, 7:40 pm
Location: Chicago IL/Oconomowoc WI

Post Posted June 18th, 2017, 1:37 pm

.
In case you were not aware:

Mozillazine wrote:We folks are not part of Mozilla.
Established in 1998, MozillaZine is an independent Mozilla news, community and support site.
MozillaZine is not run by the Mozilla Foundation and is not an official part of the Mozilla project.



.
SeaMonkey 2.46 - FF 54.0 - TB 52.2 - Mac OSX 10.12.5 Quad-Core Intel Xeon 5500
Computers I've used: IBM 7094/UNIVAC 1108/IBM 360/DEC PDP11/DEC VAX-11 780/DEC VAXstation 8000/Sun SPARCstation 2/Mac from 1984 to 2017

Happy112

User avatar
 
Posts: 196
Joined: April 15th, 2017, 10:25 am
Location: Never-Never-Land

Post Posted June 18th, 2017, 1:53 pm

RobertJ wrote:.
In case you were not aware:

Mozillazine wrote:We folks are not part of Mozilla.
Established in 1998, MozillaZine is an independent Mozilla news, community and support site.
MozillaZine is not run by the Mozilla Foundation and is not an official part of the Mozilla project.



.



And : " MozillaZine is hosted at the Open Source Lab at Oregon State University "

Ling Ling
 
Posts: 10
Joined: June 17th, 2017, 9:08 pm

Post Posted June 18th, 2017, 7:36 pm

James wrote:
Ling Ling wrote:Please check why this extension has been added without my approval?

Neither Mozilla or the Firefox web browser would add such an Extension.

This looks to be from malware. A search in search engines for @extcorp.com.xpi gives many results with random numbers before the @.

https://support.mozilla.org/en-US/kb/tr ... ed-malware

It automatically added this extension without my approval.
This is a bug of Firefox!

Ling Ling
 
Posts: 10
Joined: June 17th, 2017, 9:08 pm

Post Posted June 18th, 2017, 7:37 pm

Brummelchen wrote:1. AdwCleaner AdwCleaner Download
Insert [Report] here, then [Cleanup]

2. Let Malwarebytes (install as free) search
Download https://www.malwarebytes.org/antimalware/
Insert logfile here

I tried these 2 tools plus other 13 anti virus tools, still cannot clean this malware.

Ling Ling
 
Posts: 10
Joined: June 17th, 2017, 9:08 pm

Post Posted June 18th, 2017, 7:42 pm

I used file explorer to find the path:
C:\Users\Ling\AppData\Roaming\Mozilla\Firefox\Profiles\sconsrm8.default\extensions\455574@extcorp.com.xpi

Deleted this xpi, then restarted Firefox.
It is ok now.
But why Firefox allows adding extension without my approval???

Ling Ling
 
Posts: 10
Joined: June 17th, 2017, 9:08 pm

Post Posted June 18th, 2017, 7:53 pm

James wrote:
Ling Ling wrote:Please check why this extension has been added without my approval?

Neither Mozilla or the Firefox web browser would add such an Extension.

This looks to be from malware. A search in search engines for @extcorp.com.xpi gives many results with random numbers before the @.

https://support.mozilla.org/en-US/kb/tr ... ed-malware

I have searched some China web sites and Russia web sites, then added this extension without my notice!
I wonder why Firefox allows adding third party extension without the user approval!
This is a danger loophole!

James
Moderator

User avatar
 
Posts: 26778
Joined: June 18th, 2003, 3:07 pm
Location: Made in Canada

Post Posted June 18th, 2017, 9:18 pm

If Mozilla was aware of this malware Extension then it would be on the blocklist mentioned at https://addons.mozilla.org/blocked/

Happy112

User avatar
 
Posts: 196
Joined: April 15th, 2017, 10:25 am
Location: Never-Never-Land

Post Posted June 18th, 2017, 11:16 pm

@ Ling Ling :

You posted this question on McAfee support forum as well, and have been giving the same answers so far.
You seem to be convinced that Firefox ALLOWS malware to slip through the cracks, but rest assured :
Firefox will do no such thing !
(Hence the link James gave you)
In a perfect world there wouldn't be any malware, but as long as there are 'some people' ......

RobertJ
Moderator

User avatar
 
Posts: 9981
Joined: October 15th, 2003, 7:40 pm
Location: Chicago IL/Oconomowoc WI

Post Posted June 19th, 2017, 4:53 am

.
As noted FF doesn't allow malware; however, the user can allow it by going to nasty web sites. It is your computer; you control it.

.
SeaMonkey 2.46 - FF 54.0 - TB 52.2 - Mac OSX 10.12.5 Quad-Core Intel Xeon 5500
Computers I've used: IBM 7094/UNIVAC 1108/IBM 360/DEC PDP11/DEC VAX-11 780/DEC VAXstation 8000/Sun SPARCstation 2/Mac from 1984 to 2017

Happy112

User avatar
 
Posts: 196
Joined: April 15th, 2017, 10:25 am
Location: Never-Never-Land

Post Posted June 19th, 2017, 5:40 am

RobertJ wrote:.
As noted FF doesn't allow malware; however, the user can allow it by going to nasty web sites. It is your computer; you control it.




Hear ! Hear ! (thumbs up !)

Return to Firefox Support


Who is online

Users browsing this forum: Bing [Bot] and 21 guests