plc.myforum.ro

kosta · Member Joined: 09 Aug 2015 Posts: 161 Location: Salonic

Rogue extensions that hijack Chrome & Firefox are near impossible to remove
https://www.neowin.net/news/rogue-extensions-that-hijack-chrome--firefox-are-near-impossible-to-remove

As discovered by Malwarebytes researcher Pieter Arntz, a new pair of extensions plaguing Google's Chrome and Mozilla's Firefox can hijack the browsers in order to push technical support scams at you and potentially even spy on your browsing activities.

Called "Tiempo en colombia en vivo" on the Chrome Web Store, the rogue extension can be installed on a machine when the user visits certain sites; trying to leave a malicious site results in an infinite loop of dialog boxes cautioning the user that they can't leave the page until they install the extension. If they try to leave still, and choose the option to "Prevent this page from creating additional dialogs," the tab will go into full screen mode and offer the 'Add extension' dialog popup that shows up when installing a Chrome extension

The only means of successfully removing the extension at this point is, per Artnz, to install Malwarebytes and let the anti-malware program do it for you. Alternatively, you may also try and manually browse to the extension's folder and rename '1499654451774.js', which is the JavaScript file the extension relies on. You can then restart Chrome and will be able to access the browser's extension settings as normal, with the offending extension shown as being corrupted - and unable to work its nefarious magic as it can't find the files it's looking for. You can then proceed to delete it as you normally would.

A similar extension for Firefox was also found by the researcher, which is propagated by ad-rotators showing it as a 'manual update for Firefox' and tricking users into installing it. This, too, has similar feature aimed at making its removal more difficult by closing any tab that contains the 'about:addons' string - the page you'd use to manage and delete extensions in Firefox.

https://www.neowin.net/news/rogue-extensions-that-hijack-chrome--firefox-are-near-impossible-to-remove