936214 - Blocklist Plus-HD add-ons... somehow

Status: RESOLVED INVALID

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Kris Maglione [:kmag]]

I haven't come across an XPI for these, but they use a new ID for each version, in the form "${guid1}@{guid2}.com". E.g.,


[e-mail] Plus-HD-1.1
[e-mail] Plus-HD-1.3
[e-mail] Plus-HD-1.5
[e-mail] Plus-HD-1.6
[e-mail] Plus-HD-1.7
[e-mail] Plus-HD-2.2
[e-mail] Plus-HD-2.3
[e-mail] Plus-HD-2.4
[e-mail] Plus-HD-2.5
[e-mail] Plus-HD-2.6
[e-mail] Plus-HD-3.5
[e-mail] Plus-HD-3.7
[e-mail] Plus-HD-3.8
[e-mail] Plus-HD-4.1
[e-mail] Plus-HD-4.4
[e-mail] Plus-HD-4.5

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

This seems to be the official source: http://www.plus-hd.com/

Care to give it a try?

Comment 2

[Kris Maglione [:kmag]]

Yeah, that installer silently installs it.

Comment 3

[Kris Maglione [:kmag]]

Except that it installs 'Plus HD' 9.91.10 with ID [e-mail]

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Kris, do you want a xpi and installer with that file? Furthermore, it creates tasks to install (and reinstall?) itself and terminates running browsers.

Comment 5

[Kris Maglione [:kmag]]

I'm not sure what you mean

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

(In reply to Kris Maglione [:kmag] from comment #0)
> I haven't come across an XPI for these, but they use a new ID for each
> version, in the form "${guid1}@{guid2}.com". E.g.,

(In reply to Kris Maglione [:kmag] from comment #3)
> Except that it installs 'Plus HD' 9.91.10 with ID
> [e-mail]

Do you need a software which silently installs Plus HD 7.6 (and the stuff like install log etc.)?

Comment 7

[Kris Maglione [:kmag]]

If you have it, then yes, I'd like to see it. The installer from comment 1 installs something, but I don't know that it's related.

Comment 8

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Attachment: extractnow installer (zipped with password 'trash')

This is an installer of the ExtractNow application. The homepage http:// www . extractnow . com/ offers a download from cnet which seems to be a stub. The download from CHIP http://www . chip . de/downloads/ExtractNow_48251973.html offers to install third party stuff, but even after unchecking the checkbox and declining that TOS, Plus HD 7.6 gets installed.

More information on changes to the system can be found on http://www.drwebhk.com/en/virus_techinfo/Trojan.Crossrider.41.htmlr

TL;DR

- Tasks created at %WINDIR%\Tasks\
- %PROGRAM_FILES%\Plus-HD-6.0
- %TEMP%\nsq3.tmp
- In Temp:
binsis142.xml
binsischeck654.xml
bitool.dll
nsr701.tmp
plus-hd-7-6de.exe
Plus-HD-7.6Installer_1393425650.log
UpdateCheckerSetup.exe
Folders with *.tmp folder, one containing Setup50131.exe

Comment 9

[Kris Maglione [:kmag]]

Hrm. That installer changes my homepage and search engine to snapdo.com. It doesn't seem to install any extensions, though.

Comment 10

[Kris Maglione [:kmag]]

OK, it's pretty flaky, but eventually it does install a snap.do extension. Which we should block. But that's another bug. It also uses an external app to draw its toolbar over our browser window. Ugh.

Comment 11

[Kris Maglione [:kmag]]

These are now also showing up as 'PlusSHD' and causing crashes:

[e-mail]	PlusSHD-9.9
[e-mail]	PlusSHD-9.9

Comment 12

[Jorge Villalobos [:jorgev] (he/him)]

Closing old blocklist requests that shouldn't be valid after the move to WebExtensions-only in Firefox 57. Please comment if you think this bug is still valid and should be reopened.