[malware] App of the Day (don't install !)

Everything about using Adblock Plus on Google Chrome
smblkc

Re: [adware] App of the Day

Post by smblkc »

T.C. wrote:Fastest Fox!
This is what did it to my system. Luckily, they have the option to turn it off in their settings.
erkme73
Posts: 7
Joined: Mon Jul 21, 2014 6:12 am

Re: [adware] App of the Day

Post by erkme73 »

I do wonder about the timing of all of these extensions going rogue at the same time. Seems awfully suspicious that so many developers would sell out to superfish, and then all of them go "live" with this bug at the same time.

I'm thinking they've been rogue for quite a while, and no one knew. Then perhaps with one of the most recent filter updates for ABP, it finally started jamming the communications between the malicious code and the superfish servers. Thus, exposing how many extensions were really loaded with malware/adware.

If anything, it's a big hats-off to ABP for making us aware of this garbage.

The other alternative is that there is a, as of yet unknown virus, that is able to manipulate the code of a number of different extensions without the user (or developer) knowing anything about it. I am curious to know if people who've had compromised extensions were to DELETE them (not just disable them) and then re-install them from the store, if the superfish code immediately reappears.

I would test it with my culprit (Service Pages for Google Chrome 5.0.4) but it's been pulled from the store. If anyone has an extension that is still available, give it a try.

If it turns out the original extension from the store is legitimate without the code, then we may be erroneously faulting the developers for conspiring with superfish. And it would point to a bigger security problem, as it means superfish has been able to compromise extensions at will, without the developers' consent.
erkme73
Posts: 7
Joined: Mon Jul 21, 2014 6:12 am

Re: [adware] App of the Day

Post by erkme73 »

I just installed FastestFox - an extension I've never had on any of my machines. Immediately the superfish text came back. This to me means the developers are including the code in their packaged installs at the store.

If anyone knows how to report these to Google/Chrome, please take the extra step and do so. Perhaps if the extensions get pulled quickly, the devs will see that selling out does nothing for them long-term as the death of their code will happen quickly.
User avatar
mapx
Posts: 21940
Joined: Thu Jan 06, 2011 2:01 pm

Re: [adware] App of the Day

Post by mapx »

erkme73 wrote: If anyone knows how to report these to Google/Chrome, please take the extra step and do so.
forum/viewtopic.php?p=103173#p103173

report the extension to chrome web store:

1. Go to the item's details page in the Chrome Web Store.
2. Click on the Details.
3. Click on the Report abuse button.
4. Fill out the form and click Submit.
Dekard

Re: [adware] App of the Day

Post by Dekard »

New Tab Page was it.
324b21

Re: [adware] App of the Day

Post by 324b21 »

found the little rascal. Everplex Dark + Black Theme for YouTube 17.0.4
erkme73
Posts: 7
Joined: Mon Jul 21, 2014 6:12 am

Re: [adware] App of the Day

Post by erkme73 »

Thanks Mapx for describing the report abuse steps. I've gone back and made a list of all the reported extensions, logged into the Chrome store, and reported every single one of them. I suggest everyone do the same.
bocapope

Re: [adware] App of the Day

Post by bocapope »

My culprit was Lyrics for Google Chrome...
Montar

Re: [adware] App of the Day

Post by Montar »

Mine was Incognito this
GUEST

Re: [adware] App of the Day

Post by GUEST »

Guest wrote:
App of the Day is a feature of Pet Match and uses visual search technology to find you relevant and related content from thousands of sites across the web. Just click on or hover over the orange InSite icon to open this window and discover related content. To disable this feature, click here. If you wish to share any feedback on this feature, contact us at feedback@similarproducts.net App of the Day
As of about an hour ago I'm seeing this spam EVERYWHERE. When I disable Adblock Plus, it goes away. What's going on here?
Yes, this is on all my webpages(except my homepage). I'm using Firefox. "To disable this feature, click here." DOESN'T WORK. I'm not tech savvy. Any help would be much appreciated. Thank you.
User avatar
mapx
Posts: 21940
Joined: Thu Jan 06, 2011 2:01 pm

Re: [adware] App of the Day

Post by mapx »

for firefox the same:

-scan your system for adware / malware
do it first using malwarebytes antimalware
http://www.softpedia.com/get/Antivirus/ ... ware.shtml

then using adwcleaner
http://www.softpedia.com/progDownload/A ... 12632.html

then:
-disable / remove your addons 1 by 1
-restart firefox
-see if still happens
-repeat for all your addons
Stufferino

Re: [adware] App of the Day

Post by Stufferino »

Mine was Awesome New Tab Page. I didn't fancy removing it, so I figured out you can disable that... "feature" by
1. Going to your extensions and finding ANTB
2. On the bottom row where it says "Allow in incognito Allow access to file URLs Options" - click on options.
3. Scroll down and you'll see two toggle-able 'features' in the advertisements section, one from RevJet, and one from Superfish - the culprit behind this issue.
Simply turn them off and you're good to go without removing the extension.

Although mine was ANTB, I've heard that similar options are available for other extensions which also have this issue. I suggest you all go to your options page and see for yourselves before getting rid of any extensions you may still want.
GUEST

Re: [adware] App of the Day

Post by GUEST »

Thanks for speedy reply. I'm trying removal now........ :wink:
eziggy3

Re: [adware] App of the Day

Post by eziggy3 »

Running Adblock 2.7.7
User avatar
mapx
Posts: 21940
Joined: Thu Jan 06, 2011 2:01 pm

Re: [adware] App of the Day

Post by mapx »

eziggy, that one isnt adblock plus

remove it, install the last dev build adblock plus for safari from
devbuilds/adblockplussafari/00latest.safariextz

and ...I told you, remove all the other extensions (then you can try 1 by 1 adding them again and testing after each 1)
Locked