MozillaZine

adblock not installed but detects crypto currency mining

User Help for Mozilla Firefox
ttggzz
 
Posts: 27
Joined: November 15th, 2007, 8:04 pm

Post Posted December 18th, 2017, 11:23 am

Hi, FF57 running on Linux, I have adblocker ultimate installed but not "adblock". I just started getting this banner saying "adblock has detected an attempt by this website to use your browser as a cryto-currency miner. It can create significant CPU load. Press "cancel" to prevent it".

Kind of worrisome because I don't have this "adblock" installed, could it be a part of adblocker ultimate? Here's the link it's happening on [a musician gear site]:
https: .gearslutz.com/board/live-sound/863548-volume-pedal.html

A laptop died and I moved the ssd to a backup laptop of the same make and model. FF has been really slow, I thought it might be something to do with changing computers [slightly slower processor], but now I'm getting the crypto currency thing so wonder if I've been attacked.

Previous to the warnings I tried in safe mode with just a couple of tabs open. Same thing, the sideways bouncing ball for 10-20 seconds before the page is loaded.
thanks for your time and any info!
Last edited by LIMPET235 on December 19th, 2017, 3:04 am, edited 1 time in total.
Reason: Killed the live link/s.

Gingerbread Man

User avatar
 
Posts: 7734
Joined: January 30th, 2007, 10:55 am

Post Posted December 18th, 2017, 12:35 pm

Hello,
ttggzz wrote:could it be a part of adblocker ultimate?

One easy way to tell is to disable Adblocker Ultimate in the Add-ons Manager, then reload the page and see if you still get the message.
ttggzz wrote:Here's the link it's happening on [a musician gear site]:

Well I for one am not visiting a site that wants to use my system to mine for cryptocurrencies. Such sites have either been hacked, or they're doing it intentionally, in which case they might be trying even shadier stuff than that. Of course, it could be a false positive from your add-on.

therube

User avatar
 
Posts: 18481
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Post Posted December 18th, 2017, 2:08 pm

This, AdBlocker Ultimate?
Why did you choose that (it does seem to have glowing reviews ;-))?
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript

ttggzz
 
Posts: 27
Joined: November 15th, 2007, 8:04 pm

Post Posted December 18th, 2017, 2:23 pm

One easy way to tell is to disable Adblocker Ultimate in the Add-ons Manager, then reload the page and see if you still get the message.

OK I just disable AU and everything [tabs opening] appears to be blazing fast again. Also, "gearslutz", which is a huge highly popular site, now opens normally [which it always has]. I'll have to look into this in more detail later, thanks

Reflective

User avatar
 
Posts: 2283
Joined: February 15th, 2007, 11:13 am

Post Posted December 18th, 2017, 2:45 pm

There's an extension you can install to block crypto currency miners: https://addons.mozilla.org/en-US/firefox/addon/no-coin/

ttggzz
 
Posts: 27
Joined: November 15th, 2007, 8:04 pm

Post Posted December 18th, 2017, 2:56 pm

There's an extension you can install to block crypto currency miners: https://addons.mozilla.org/en-US/firefox/addon/no-coin/

Thanks, I'll look into that, the mystery at the moment now appears to be Adblocker Ultimate. Like I said earlier, I had to migrate ssd to a different laptop [same model], any tab loading was excruciatingly slow, youtube videos very sketchy, I thought it had something to do with the migration. Just now trying some YT with AU disabled, ragingly prompt response, move cursor anywhere in video immediately jumps there.

I'd guess some kind of a bug in adblocker ultimate, false positive? Just happy to be up to speed again.

I had read about crypto mining, it is not OS dependent, they could be attacking a Linux machine? thanks

ttggzz
 
Posts: 27
Joined: November 15th, 2007, 8:04 pm

Post Posted December 18th, 2017, 3:15 pm

On another note, as I also mentioned, I tried last night with /all/ addons disabled, and still was slow. hmmm...

ttggzz
 
Posts: 27
Joined: November 15th, 2007, 8:04 pm

Post Posted December 19th, 2017, 7:22 am

Why did you choose that (it does seem to have glowing reviews ;-))?

Mainly because a non-mainstream media news site [blacklistednews dot com] I look at every evening has the most obnoxiously distracting sometimes bordering on visually disturbing ads I have ever seen, plastered all over the place. AU did the best job of killing them, but they still come back when you click on a news story. Other than that it just seemed like a good idea at the time, compared to what I was seeing about other options.

Reflective

User avatar
 
Posts: 2283
Joined: February 15th, 2007, 11:13 am

Post Posted December 19th, 2017, 9:53 am

therube wrote:This, AdBlocker Ultimate?
Why did you choose that (it does seem to have glowing reviews ;-))?

It's beginning to look like the 'glowing reviews' might be mostly fake. There's an article on ghacks.net concerning a similar problem with a spammer using the same "Anonymous" handle. Reviews for Adblock Ultimate also show a significant number with "Anonymous user (random alphanumeric)" giving the app a sparkling review.

In addition to that the developer for Adblocker Ultimate seems to be a company called Secure Download Ltd.. A quick search of the web finds a PUP by the name of SoftPlanet Update Manager also made by Secure Downbload Ltd. Malwarebytes has instructions on how to remove it. In the registry details you'll find Secure Download Ltd. as the publisher.

It seems a bit odd then that here you have two apps from the same developer one of which contains adware and one which is supposed to remove it. Also the FF extension doesn't list any crypto-miner blockers as being present in the app and it won't be the first time that an app contains fake messages which it displays from time to time to make you think it's doing a good job.

Personally, I'd remove Adblock Ultimate if I had it installed and go with one of the mainstream Adblockers like Adblock Plus or uBlock Origin. You can add anti-crypto miner blockers using the filters published here: https://filterlists.com/

8-bit

User avatar
 
Posts: 908
Joined: October 19th, 2007, 5:19 pm

Post Posted December 20th, 2017, 1:53 am


ttggzz
 
Posts: 27
Joined: November 15th, 2007, 8:04 pm

Post Posted December 23rd, 2017, 4:51 pm

Personally, I'd remove Adblock Ultimate if I had it installed

Thanks, yeah I've had it removed for a while. What was strange was that the pop up/warning on that page didn't say adblock ultimate, it just said "adblock". Maybe they shortened it. I'm just relieved my browser is back up to speed. I just installed the crypto miner blocker mentioned earlier, see how it goes.
thanks

flaneurb
 
Posts: 618
Joined: December 10th, 2011, 3:50 am

Post Posted December 23rd, 2017, 9:23 pm

@ttggzz, what do you see in the Extensions section of about:support?

Brummelchen
 
Posts: 3273
Joined: March 19th, 2005, 10:51 am

Post Posted December 24th, 2017, 1:40 am

"adblocker ultimate" is an adguard clone.

against coin/miners add this list (currently 62 entries)
https://raw.githubusercontent.com/hoshs ... nocoin.txt

(usable in original Adblock (Plus), uBlock and similar, but not in blockers with a fixed list)

using uBlock i cant see anything concerning mining in network logger (not logged in).

blocked:
trackcmp.net
use.fontawesome.com
advertserve.com

maybe more scripts when logged in or when theses sites loaded.
but uBlock is superior (and independent)

Return to Firefox Support


Who is online

Users browsing this forum: No registered users and 11 guests