Archive for Februar, 2014

Bad Firefox Extensions

Samstag, Februar 15th, 2014

I just found out, that firefox still ran after closing it.
That was strange, so I revisited its extensions.

I found a strange extension
{1c0d37be-0673-4869-ad47-0061db41421e}.xpi
which was installed on 2013-11-08.
I am not very good in reading extension programs. But the only clou I found was a link to an update URL
https://dummf1up57pez.cloudfront.net/watcher/update.rdf

I looked at
https://dummf1up57pez.cloudfront.net/
and received a list of extensions? Most of them had something with „ad“ in their name. I suppose it stands for advertising.

Another extension
{9eddbc41-e7af-4406-a5a9-f50569c24787}.xpi
declared itself to be a Zip File Wizard Free 4.0.5.3 .
I am sure that I never installed such a thing manually. Why should I when my operating system opens zip files easily? The extension has a timestamp 2013-11-11.
I digged into it and found the URL
https://ads.googloapis.com/

Googlo? Sounds fishy. And ads? Strange.

I suppose they came with an extension called youtube unblocker (which does not work very well, btw).

I just deleted all three. I suggest you do the same.

If you want to examine the plugins yourself, You can download the {1c0d37be-0673-4869-ad47-0061db41421e} plugin and the zip file wizard free firefox plugin.
I renamed the file suffix from xpi to zip. Do not install them!