880858 - Block TopArcadeHits Addon

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Policy Requests, defect)

Description

[formerly wakaflocka]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0 (Beta/Release)
Build ID: 20130512193902

Steps to reproduce:

I didnt do anything, this user downloaded a application from download.com (CNET) and was infected with this unremoveable addon "Top Arcade Hits". The user tried to reset, safemode, and a check for malware and it still persisted.
More info: https://support.mozilla.org/en-US/questions/960863


Actual results:

It infected the user and he/she tried to remove it using Anti-Malware Programs.
More Info: https://support.mozilla.org/en-US/questions/960863


Expected results:

It should have never been installed or be allowed to.

Comment 1

[formerly wakaflocka]

http://forums.mozillazine.org/viewtopic.php?f=38&t=2711837
These users also had problems with removing it, even though it came sucessful.

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

It looks like the main problem was that the add-on was globally installed, so it can only be disabled and not fully removed. That's a known bug in Firefox (bug 640775).

So, unless the add-on does something else wrong, we won't block it. Please reopen if you have more information about it.

Comment 3

[formerly wakaflocka]

Reopening, ads and sites etc show as said here 

* https://support.mozilla.org/en-US/questions/960863?page=3#answer-470399

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

Showing ads or opening up pages is not sufficient reason to block an add-on. Please read our guidelines to know the reasons we will block add-ons for: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Add-on_guidelines

If the add-on is opening insecure sites or trying to trick the user into doing something, then we can consider a block. For what I read in that comment, the add-on was just showing some "adult" content that offended the user.

So, again, if there is any known violation of our guidelines, please reopen.

Comment 5

[David Weir (satdav)]

this addon will only disabled and will not be completly unstalled

Comment 6

[David Weir (satdav)]

https://crash-stats.mozilla.com/report/index/e21e57ec-d424-4a28-9b03-8b0222130822 could be caused by this addon

Comment 7

[u279076]

(In reply to David Weir (satdav) from comment #6)
> https://crash-stats.mozilla.com/report/index/e21e57ec-d424-4a28-9b03-
> 8b0222130822 could be caused by this addon

I don't see it listed in the correlation reports:
21% (15/72) vs.   1% (1090/95359) [e-mail]
10% (7/72) vs.   0% (451/95359) {0113D088-8ED1-468C-B225-585A9C53B5E3}
10% (7/72) vs.   1% (1230/95359) [e-mail]
7% (5/72) vs.   0% (246/95359) [e-mail]
8% (6/72) vs.   2% (2370/95359) [e-mail]
6% (4/72) vs.   0% (161/95359) 7iffxtbr@PopularScreensavers_7i.com
6% (4/72) vs.   0% (203/95359) [e-mail]
6% (4/72) vs.   0% (302/95359) [e-mail]
6% (4/72) vs.   0% (405/95359) 39ffxtbr@MapsGalaxy_39.com

Also, this is not a topcrash, it's currently sitting at #145 of all Browser crashes on Release. I don't think we'll reconsider blocking this add-on unless it becomes explosive.

If this add-on is causing you problems I suggest you try one of the documented workarounds.

Comment 8

[formerly wakaflocka]

Anyway the addon is considered as malware.

* https://www.mywot.com/en/forum/35818-toparcadehits-com-virus-cnet-malware

And there is a large discussion on sumo about this malware on firefox.

Comment 9

[formerly wakaflocka]

also see

* http://forums.mozillazine.org/viewtopic.php?f=38&t=2711837
* http://www.bleepingcomputer.com/forums/t/496414/toparcadehits-games-virus/
This one is real good, even the title.
* http://forums.mozillazine.org/viewtopic.php?f=38&t=2740265
"Toparcadehits" Firefox extension keeps re-installing itself"

Comment 10

[John Hesling [:John99] (NeedInfo me)]

I have so far tried to keep my own comments within sumo, that is IMO better suited to discussions than is a bug report. The facts as I see them at present:

I see evidence that it is unwanted and inconvenient adware. However despite sometimes directly asking in the SUMO AAQ forum threads I have not yet seen conclusive evidence of wrong doing by this software. 

It has a EULA/TC warning it changes browser settings:http://toparcadehits.com/terms-of-use/
It has an obvious use and purpose: playing arcade games !

The TopArcadeHits site did have an installer that; per sumo posts; had been confirmed to work: http://toparcadehits.com/deactivate/
The site currently advises; from the above link; to use the Windows control panel. So maybe any separate uninstaller is not now even necessary or openly provided. 

Maybe someone should investigate and give STR. 
Try installing and uninstalling this software. 
If uninstalling is impossible, or impossible from the Windows control panel. 
Or if damage or wrongdoing is seen report it in this bug with STR.
(Not something I wish to try personally. Anyhow I normally do not use Windows) 
Otherwise we are trying to work relying on hearsay evidence.
 
Just a couple of other observations 
Was the malware report quoted initiated mainly by the bug reporter ?
Do possibly some of the users with this software also have other bundled software or even malware on their machines. 
If while on sumo yourself and logged in you find posts providing evidence supporting this bug,that I may be unaware of, perhaps you would send me a pm https://support.mozilla.org/en-US/messages/new?to=John99

Comment 11

[formerly wakaflocka]

User reported that the addon confirm screen was never seen and uninstalling from the control panel was not possible (i assume the uninstaller does). I can test this myself (on a VM sometime this week possibly).

Though the addon was said to
* Bypass the addon install screen
* Uninstallable from the control panel (you may need to use their uninstall tool)
* Ads (links and id guess, popups of somekind)
* Info from => https://support.mozilla.org/en-US/questions/960863?page=3#answer-473353
But when I get time i will test myself.

Comment 12

[Kris Maglione [:kmag]]

Have you managed to find any more information on this? I'm highly suspicious of this add-on. I haven't been able to find an installer myself, but all of the support requests I've seen suggest that users did not expect it to be installed. It also has an unusually high proportion of enabled foreign installs, and a high percentage of users who only use a non-default search engine.

Comment 13

[formerly wakaflocka]

Yeah I'm not trying this **** on my computer, but there is some (little) negative feedback on the addon thru the input site.

* https://input.mozilla.org/en-US/?q=TopArcadeHits&date_start=2013-07-06&selected=90d&date_end=2013-12-06#

Its installed through Cnet as a wrapper on other programs or as a regular download (its own page).

LOL - Google search usually points to resolutions to removing it instead of installing it.

* https://www.google.com/search?client=ubuntu&channel=fs&q=toparcadehits+addon&ie=utf-8&oe=utf-8

If i could find just the XPI of the addon I would install it anyways.

Comment 14

[Kris Maglione [:kmag]]

I suggest using VirtualBox. You can take a snapshot of the VM before you install things and revert to it afterwards.

Comment 15

[formerly wakaflocka]

Yeah um..... it doesnt work so I might as well infect my actual computer, I can remove it anyways.

Comment 16

[formerly wakaflocka]

I downloaded the setup file from cnet and only installed Toparcadehits related stuff (installs lots of **** by its self).

I ran the wrapper, It asked me do I want to also install Connect Toolbar and set search defualt to conduit also installing SearchProtect.

The third step asks to install MyPCBackup.

So then it downloaded a 200kb install File.


After the install, I tried to play but it wouldn't open at all, but there is a lot of disk access.
So the fact that it is patched with a bunch of other **** overshadowes TopArcadeHits and I didn't see any hijacking in Firefox or IE.

It has seemed to affect stuff in the past... so maybe they changed something or it just doesn't hijack right.

Comment 17

[Jorge Villalobos [:jorgev] (he/him)]

It looks like this investigation reached a dead end. Please reopen if you have more information about it.