Hijacked by extcorp.com.xpi

[Ling Ling]

Dear Sirs,

My Firefox browser has been hijacked. It has been added the following extension:

Extension Tables 2.5 default Firefox 54.0 C:\Users\Ling\AppData\Roaming\Mozilla\Firefox\Profiles\sconsrm8.default\extensions\455574@extcorp.com.xpi

Google.com search page has been added advertising photo. Many advertising web sites have been poped up.

Please check why this extension has been added without my approval?

Best regards,
Ling

[James]

Please check why this extension has been added without my approval?

Neither Mozilla or the Firefox web browser would add such an Extension.

This looks to be from malware. A search in search engines for @extcorp.com.xpi gives many results with random numbers before the @.

https://support.mozilla.org/en-US/kb/tr ... ed-malware

[JayhawksRock]

Something here may help remove the Badware you installed... Good Luck
https://www.google.com/#q=extcorp.com

[Happy112]

In addition to running the scans :

Go to the 3-bar menu => Addons => and look for any unfamiliar or suspicious looking extensions, like e.g.:
SafeSearch Incognito
SearchAssist Incognito
When you do find any : remove them.

(Re: 'Dear Sirs' - it's a mans', man's, man's world .......)

[Brummelchen]

1. AdwCleaner AdwCleaner Download
Insert [Report] here, then [Cleanup]

2. Let Malwarebytes (install as free) search
Download https://www.malwarebytes.org/antimalware/
Insert logfile here

[RobertJ]

.
In case you were not aware:

We folks are not part of Mozilla.
Established in 1998, MozillaZine is an independent Mozilla news, community and support site.
MozillaZine is not run by the Mozilla Foundation and is not an official part of the Mozilla project.

.

[Happy112]

.
In case you were not aware:

We folks are not part of Mozilla.
Established in 1998, MozillaZine is an independent Mozilla news, community and support site.
MozillaZine is not run by the Mozilla Foundation and is not an official part of the Mozilla project.

.

And : " MozillaZine is hosted at the Open Source Lab at Oregon State University "

[Ling Ling]

Please check why this extension has been added without my approval?

Neither Mozilla or the Firefox web browser would add such an Extension.

This looks to be from malware. A search in search engines for @extcorp.com.xpi gives many results with random numbers before the @.

https://support.mozilla.org/en-US/kb/tr ... ed-malware

It automatically added this extension without my approval.
This is a bug of Firefox!

[Ling Ling]

1. AdwCleaner AdwCleaner Download
Insert [Report] here, then [Cleanup]

2. Let Malwarebytes (install as free) search
Download https://www.malwarebytes.org/antimalware/
Insert logfile here

I tried these 2 tools plus other 13 anti virus tools, still cannot clean this malware.

[Ling Ling]

I used file explorer to find the path:
C:\Users\Ling\AppData\Roaming\Mozilla\Firefox\Profiles\sconsrm8.default\extensions\455574@extcorp.com.xpi

Deleted this xpi, then restarted Firefox.
It is ok now.
But why Firefox allows adding extension without my approval???

[Ling Ling]

Please check why this extension has been added without my approval?

Neither Mozilla or the Firefox web browser would add such an Extension.

This looks to be from malware. A search in search engines for @extcorp.com.xpi gives many results with random numbers before the @.

https://support.mozilla.org/en-US/kb/tr ... ed-malware

I have searched some China web sites and Russia web sites, then added this extension without my notice!
I wonder why Firefox allows adding third party extension without the user approval!
This is a danger loophole!

[James]

If Mozilla was aware of this malware Extension then it would be on the blocklist mentioned at https://addons.mozilla.org/blocked/

[Happy112]

@ Ling Ling :

You posted this question on McAfee support forum as well, and have been giving the same answers so far.
You seem to be convinced that Firefox ALLOWS malware to slip through the cracks, but rest assured :
Firefox will do no such thing !
(Hence the link James gave you)
In a perfect world there wouldn't be any malware, but as long as there are 'some people' ......

[RobertJ]

.
As noted FF doesn't allow malware; however, the user can allow it by going to nasty web sites. It is your computer; you control it.

.

[Happy112]

.
As noted FF doesn't allow malware; however, the user can allow it by going to nasty web sites. It is your computer; you control it.

Hear ! Hear ! (thumbs up !)