If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Block TopArcadeHits Addon

RESOLVED WONTFIX

Status

()

Toolkit
Blocklisting
RESOLVED WONTFIX
4 years ago
2 years ago

People

(Reporter: formerly wakaflocka, Assigned: jorgev)

Tracking

unspecified
2014-08
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

(Reporter)

Description

4 years ago
User Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:21.0) Gecko/20100101 Firefox/21.0 (Beta/Release)
Build ID: 20130512193902

Steps to reproduce:

I didnt do anything, this user downloaded a application from download.com (CNET) and was infected with this unremoveable addon "Top Arcade Hits". The user tried to reset, safemode, and a check for malware and it still persisted.
More info: https://support.mozilla.org/en-US/questions/960863


Actual results:

It infected the user and he/she tried to remove it using Anti-Malware Programs.
More Info: https://support.mozilla.org/en-US/questions/960863


Expected results:

It should have never been installed or be allowed to.
(Reporter)

Updated

4 years ago
Component: Untriaged → Blocklisting
OS: Linux → All
Product: Firefox → addons.mozilla.org
Hardware: x86 → All
Version: 21 Branch → 4.x
(Reporter)

Comment 1

4 years ago
http://forums.mozillazine.org/viewtopic.php?f=38&t=2711837
These users also had problems with removing it, even though it came sucessful.
(Reporter)

Updated

4 years ago
Version: 4.x → unspecified
(Assignee)

Comment 2

4 years ago
It looks like the main problem was that the add-on was globally installed, so it can only be disabled and not fully removed. That's a known bug in Firefox (bug 640775).

So, unless the add-on does something else wrong, we won't block it. Please reopen if you have more information about it.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 4 years ago
Resolution: --- → WONTFIX
(Reporter)

Comment 3

4 years ago
Reopening, ads and sites etc show as said here 

* https://support.mozilla.org/en-US/questions/960863?page=3#answer-470399
(Reporter)

Updated

4 years ago
Status: RESOLVED → UNCONFIRMED
Resolution: WONTFIX → ---
(Assignee)

Comment 4

4 years ago
Showing ads or opening up pages is not sufficient reason to block an add-on. Please read our guidelines to know the reasons we will block add-ons for: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Add-on_guidelines

If the add-on is opening insecure sites or trying to trick the user into doing something, then we can consider a block. For what I read in that comment, the add-on was just showing some "adult" content that offended the user.

So, again, if there is any known violation of our guidelines, please reopen.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 4 years ago4 years ago
Resolution: --- → WONTFIX

Comment 5

4 years ago
this addon will only disabled and will not be completly unstalled

Comment 6

4 years ago
https://crash-stats.mozilla.com/report/index/e21e57ec-d424-4a28-9b03-8b0222130822 could be caused by this addon
(In reply to David Weir (satdav) from comment #6)
> https://crash-stats.mozilla.com/report/index/e21e57ec-d424-4a28-9b03-
> 8b0222130822 could be caused by this addon

I don't see it listed in the correlation reports:
21% (15/72) vs.   1% (1090/95359) ffxtlbr@delta.com
10% (7/72) vs.   0% (451/95359) {0113D088-8ED1-468C-B225-585A9C53B5E3}
10% (7/72) vs.   1% (1230/95359) addon@defaulttab.com
7% (5/72) vs.   0% (246/95359) lesstabs@lesstabs.com
8% (6/72) vs.   2% (2370/95359) plugin@getwebcake.com
6% (4/72) vs.   0% (161/95359) 7iffxtbr@PopularScreensavers_7i.com
6% (4/72) vs.   0% (203/95359) 05dd836e-2cbd-4204-9ff3-2f8a8665967d@a8876730-fb0c-4057-a2fc-f9c09d438e81.com
6% (4/72) vs.   0% (302/95359) Lyrics@LyricsContainer.co
6% (4/72) vs.   0% (405/95359) 39ffxtbr@MapsGalaxy_39.com

Also, this is not a topcrash, it's currently sitting at #145 of all Browser crashes on Release. I don't think we'll reconsider blocking this add-on unless it becomes explosive.

If this add-on is causing you problems I suggest you try one of the documented workarounds.
(Reporter)

Comment 8

4 years ago
Anyway the addon is considered as malware.

* https://www.mywot.com/en/forum/35818-toparcadehits-com-virus-cnet-malware

And there is a large discussion on sumo about this malware on firefox.
(Reporter)

Comment 9

4 years ago
also see

* http://forums.mozillazine.org/viewtopic.php?f=38&t=2711837
* http://www.bleepingcomputer.com/forums/t/496414/toparcadehits-games-virus/
This one is real good, even the title.
* http://forums.mozillazine.org/viewtopic.php?f=38&t=2740265
"Toparcadehits" Firefox extension keeps re-installing itself"
I have so far tried to keep my own comments within sumo, that is IMO better suited to discussions than is a bug report. The facts as I see them at present:

I see evidence that it is unwanted and inconvenient adware. However despite sometimes directly asking in the SUMO AAQ forum threads I have not yet seen conclusive evidence of wrong doing by this software. 

It has a EULA/TC warning it changes browser settings:http://toparcadehits.com/terms-of-use/
It has an obvious use and purpose: playing arcade games !

The TopArcadeHits site did have an installer that; per sumo posts; had been confirmed to work: http://toparcadehits.com/deactivate/
The site currently advises; from the above link; to use the Windows control panel. So maybe any separate uninstaller is not now even necessary or openly provided. 

Maybe someone should investigate and give STR. 
Try installing and uninstalling this software. 
If uninstalling is impossible, or impossible from the Windows control panel. 
Or if damage or wrongdoing is seen report it in this bug with STR.
(Not something I wish to try personally. Anyhow I normally do not use Windows) 
Otherwise we are trying to work relying on hearsay evidence.
 
Just a couple of other observations 
Was the malware report quoted initiated mainly by the bug reporter ?
Do possibly some of the users with this software also have other bundled software or even malware on their machines. 
If while on sumo yourself and logged in you find posts providing evidence supporting this bug,that I may be unaware of, perhaps you would send me a pm https://support.mozilla.org/en-US/messages/new?to=John99
(Reporter)

Comment 11

4 years ago
User reported that the addon confirm screen was never seen and uninstalling from the control panel was not possible (i assume the uninstaller does). I can test this myself (on a VM sometime this week possibly).

Though the addon was said to
* Bypass the addon install screen
* Uninstallable from the control panel (you may need to use their uninstall tool)
* Ads (links and id guess, popups of somekind)
* Info from => https://support.mozilla.org/en-US/questions/960863?page=3#answer-473353
But when I get time i will test myself.
Have you managed to find any more information on this? I'm highly suspicious of this add-on. I haven't been able to find an installer myself, but all of the support requests I've seen suggest that users did not expect it to be installed. It also has an unusually high proportion of enabled foreign installs, and a high percentage of users who only use a non-default search engine.
Status: RESOLVED → REOPENED
Ever confirmed: true
Flags: needinfo?(kdurant35rules)
Resolution: WONTFIX → ---
(Reporter)

Comment 13

4 years ago
Yeah I'm not trying this **** on my computer, but there is some (little) negative feedback on the addon thru the input site.

* https://input.mozilla.org/en-US/?q=TopArcadeHits&date_start=2013-07-06&selected=90d&date_end=2013-12-06#

Its installed through Cnet as a wrapper on other programs or as a regular download (its own page).

LOL - Google search usually points to resolutions to removing it instead of installing it.

* https://www.google.com/search?client=ubuntu&channel=fs&q=toparcadehits+addon&ie=utf-8&oe=utf-8

If i could find just the XPI of the addon I would install it anyways.
Flags: needinfo?(kdurant35rules)
I suggest using VirtualBox. You can take a snapshot of the VM before you install things and revert to it afterwards.
(Reporter)

Comment 15

4 years ago
Yeah um..... it doesnt work so I might as well infect my actual computer, I can remove it anyways.
(Reporter)

Comment 16

4 years ago
I downloaded the setup file from cnet and only installed Toparcadehits related stuff (installs lots of **** by its self).

I ran the wrapper, It asked me do I want to also install Connect Toolbar and set search defualt to conduit also installing SearchProtect.

The third step asks to install MyPCBackup.

So then it downloaded a 200kb install File.


After the install, I tried to play but it wouldn't open at all, but there is a lot of disk access.
So the fact that it is patched with a bunch of other **** overshadowes TopArcadeHits and I didn't see any hijacking in Firefox or IE.

It has seemed to affect stuff in the past... so maybe they changed something or it just doesn't hijack right.
(Assignee)

Comment 17

3 years ago
It looks like this investigation reached a dead end. Please reopen if you have more information about it.
Status: REOPENED → RESOLVED
Last Resolved: 4 years ago3 years ago
Resolution: --- → WONTFIX
(Assignee)

Updated

3 years ago
Assignee: nobody → jorge
Target Milestone: --- → 2014-08
Product: addons.mozilla.org → Toolkit
You need to log in before you can comment on or make changes to this bug.