1026056 - Blocklist Shop_an_Uplocklist add-on

Status: RESOLVED INVALID

(Toolkit :: Blocklist Policy Requests, defect, P3)

Description

[titob]

User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140605174243

Steps to reproduce:

Hello, I'm currently helping some friends to clean the Firefox installation. There is an addon that does not want to "disappear" Shop_an_Up-1.4 , Version 0.94.102

If I disable the extension and restart firefox everything is good, but as soon as the computer is restarted it appears again. I'm not sure what type of extension is this, but surely add some type of malware, some windows with ads popup, and I don't know what else. The usual warning message of "addons installed via external software" when starting Firefox does not appear. It installs and auto-enable by itself. Please block this add-on. Publisher is "Winportal"

An ad that just appeared while writing this hxxp://operation7.axeso5.com/landing?key=adc4uy&utm_source=adcash&utm_medium=cpa&utm_campaign=operation7_uru

Definitively looks like malware https://www.google.com.uy/search?q=Shop_an_Up&ie=utf-8&oe=utf-8&rls=org.mozilla:es-ES:official&client=firefox-a&channel=sb&gws_rd=cr&ei=tjafU8PFDdOksQSOloG4Aw

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Can you give us the add-on ID from about:support?

Comment 2

[titob]

I managed to remove the software and is not appearing in "about:support", The addon ID from a backup copy looks like em:id="[e-mail]"
I zipped the file to (please be careful)  hxxps://www.sendspace.com/file/iyf5zw and also hxxp://speedy.sh/rySYx/a346f15b-f72e-4205-b29d-52ad46792214-bf4b3822-f1de-4b29-8f70-c0a27f6ca2b8.com.zip 

Thanks you!

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

Since the ID appears to be randomly generated, I'm going to do a name block for Shop_an_Up.

Comment 4

[titob]

Looks very appropriated, Gracias Jorge

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

Closing old blocklist requests that shouldn't be valid after the move to WebExtensions-only in Firefox 57. Please comment if you think this bug is still valid and should be reopened.