979715 - 3 addons by the names Media Player, Media Viewer, and Media View are causing adware and trojan attacks on PC - please block (and delete?) from browser

Status: RESOLVED INVALID

(Toolkit :: Blocklist Policy Requests, defect)

Description

[emily.cho357]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20140212131424

Steps to reproduce:

A while back, my PC security expired. When visiting two writers' community and mp3 converter sites (www.youtube-mp3.org and fanfiction.net) that I thought were legitimate, my Toshiba system came down with adware and trojan viruses that popped up constantly on Windows Defender scans.


Actual results:

I looked on my Add-ons Manager, knowing that extensions sometimes cause this problem, and disabled the three suspicious-looking Media add-ons. I also went into my system registry and deleted the files bearing the names of the viruses. But they just keep coming back!


Expected results:

In addition to blocking add-ons: Set up a network that requires user permission for all parties (regardless of type) when adding components. Also, include a setting that  automatically blocks all add-ons bearing a name similar to those on the blocklist.

Comment 1

[emily.cho357]

Attachment: Mozilla Virus Screenshot.png

Comment 2

[moses]

Hi,

These 3 add-ons are generally installed alongside other "legit" programs. When you visited those sites, you probably had to install some codec or something. Personally, I use youtube-mp3.org and have not had any problems with this. I also use Adblock Plus.

Follow these steps to remove it from your system entirely. This isn't a bug in Firefox but rather a nuisance from a installed program. 
http://malwaretips.com/blogs/media-player-1-1-ads-removal/

Marking as wfm. If these steps do not work, I will re-open.

Comment 4

[moses]

Also, I recommend using avast. It's a great antivirus and I use Avast Internet Security 2014.

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

It would be useful for us if you can give us the IDs of the add-ons that caused this, since there might be something worth blocklisting there.

If you open about:support (just enter that in the location bar) there should be a list of the extensions you have installed and their IDs.

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

Closing old blocklist requests that shouldn't be valid after the move to WebExtensions-only in Firefox 57. Please comment if you think this bug is still valid and should be reopened.