917861 - AntiVirus Security Pro Malware Add-on

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Wesley Hardman]

Attachment: dff137ae-1ffd-11e3-8277-b8ac6f996f26.zip

Addons Engine 3.0.1 by Mozdev
dff137ae-1ffd-11e3-8277-b8ac6f996f26

Silent install.
It appears to have been installed with the AntiVirus Security Pro malware.

From what I can tell, it adds a script located at {todaysdate}.ff.feedmillppcsite.com to any search engine page.  The requested page url is added as a parameter to the script.  Also adds a X-Content-Security-Policy header to search engine responses to allow its scripts to be run.

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i450

Comment 2

[[:philipp]]

according to a forum entry in the support forum, this also comes under the ID & gets reinstalled after each reboot: {c54e16a7-29b3-11e3-8277-b8ac6f996f26}

Comment 3

[[:philipp]]

https://support.mozilla.org/en-US/questions/977081

Comment 4

[Jorge Villalobos [:jorgev] (he/him)]

It seems to be a different add-on, though, and I can't find anything online about it, which suggests the ID is randomized and we won't be able to block it effectively.

Comment 5

[Wesley Hardman]

Found another one with another ID.  Looks like this one is indeed randomized.

{07901aa3-29db-11e3-8277-b8ac6f996f26}

This add-on also seems to be blocking image downloads which makes it rather annoying.