Random add-ons that installs itself on firefox and google chrome without my consent
A few days ago firefox started closing on its own without any pop-up or anything. At first I thought my flash wasn't up to snuff but firefox said that I had the latest version. Then I checked my add-ons and noticed a weird add-on called EixxstraSavvINgs 4.2. Everytime I close and start firefox that add-on keeps coming back even if I uninstall it/remove it from the add-on tab. Same thing with chrome. Has anyone ever encountered something like this before? If so any help would be appreciated
Ŋuɖoɖo si wotia
Only this one: HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Xle ŋuɖoɖo sia le goya me 👍 0All Replies (15)
It could well be malware which is constantly re-installing the add-on. Have you checked your computer for malware using software such as Malwarebytes and/or Superantispyware (both have good free versions)? If not, I would recommend doing so.
I've tried using Malwarebytes but the search said nothing was out of the ordinary. Thanks for the tip though.
Try other anti-malware programs then because each one on its own is not 100%. Also use a good uninstaller like RevoUninstaller (it has a free version) to see if anything dodgy has been installed. Also use Autoruns to see if the malware is auto running any programs or services at startup.
Extensions that do not have a "Remove" button are installed by other software and are not under control of the Firefox extension manager.
Such globally installed extensions are usually found via a registry scan or are installed in a location that Firefox scans for installed extensions.
Extensions installed this way need to be removed via the settings (options/preferences) of the program that has added this extension or you need to uninstall this program via "Control Panel > Programs".
In Firefox you an only disable such an extension.
hydrurga I've tried what you recommended but neither really helped me pinpoint the problem. Yet again, thanks for the tip.
cor-el, english isn't my native language so I'm not 100% sure of what I'm supposed to do using that tip you gave me. Sorry but would you mind giving me a step-by-step?
Such extensions can be installed via the Windows registry, but only make changes there if you know what you are doing and are familiar with editing the registry as changes take effect immediately and can't be undone unless you have exported the key.
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions
You can try a malware check with more malware scanning programs on the Windows computer.
Please scan with all programs because each program detects different malware.
All these programs have free versions.
Make sure that you update each program to get the latest version of their databases before doing a scan.
- Malwarebytes' Anti-Malware:
http://www.malwarebytes.org/mbam.php - AdwCleaner:
http://www.bleepingcomputer.com/download/adwcleaner/
http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml - SuperAntispyware:
http://www.superantispyware.com/ - Microsoft Safety Scanner:
http://www.microsoft.com/security/scanner/en-us/default.aspx - Windows Defender: Home Page:
http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Spybot Search & Destroy:
http://www.safer-networking.org/en/index.html - Kasperky Free Security Scan:
http://www.kaspersky.com/security-scan
You can also do a check for a rootkit infection with TDSSKiller.
- Anti-rootkit utility TDSSKiller:
http://support.kaspersky.com/5350?el=88446
See also:
- "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked
Basically what it means is this; Start the Windows Register Editor.
On my system it is called RegEdit.
In the search bar, type Mozilla.
Then look around. DO NOT CHANGE ANYTHING!
This is where Firefox looks for some of the information it needs to run.
On this list, look for anything odd, like for example; EixxstraSavvINgs
Just type the first few characters. If you find anything,
copy the information and post it here.
DO NOT CHANGE ANYTHING!
You can do a search for EixxstraSavvINgs via Ctrl+F in the registry editor to see which keys are found and post keys that are found here as Google Chrome is involved as well like you wrote.
Do a malware check with some malware scanning programs on the Windows computer.
Please scan with all programs because each program detects different malware.
All these programs have free versions.
Make sure that you update each program to get the latest version of their databases before doing a scan.
- Malwarebytes' Anti-Malware:
http://www.malwarebytes.org/mbam.php - AdwCleaner:
http://www.bleepingcomputer.com/download/adwcleaner/
http://www.softpedia.com/get/Antivirus/Removal-Tools/AdwCleaner.shtml - SuperAntispyware:
http://www.superantispyware.com/ - Microsoft Safety Scanner:
http://www.microsoft.com/security/scanner/en-us/default.aspx - Windows Defender: Home Page:
http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Spybot Search & Destroy:
http://www.safer-networking.org/en/index.html - Kasperky Free Security Scan:
http://www.kaspersky.com/security-scan
You can also do a check for a rootkit infection with TDSSKiller.
- Anti-rootkit utility TDSSKiller:
http://support.kaspersky.com/5350?el=88446
See also:
- "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked
Thanks for that fredmcd-hotmail. I found that EixxstrasavvINgs thing located here: C:\ProgramData\EixxstraSavvINgs. Hopefully this will end this whole thing once and for all. So for now I'll delete it all and wait to see if anything happens.
Is it okey for me to delete EixxstrasavvINgs inside the registry edit? Would it affect something?
Do not remove this file yourself until it is clear that you are doing something that might affect the functioning of your computer.
At least only rename the folder where it is located if it is in its own folder and otherwise just rename the file.
It is possible that other software is involved and restores this file.
Did you check the Windows Control Panel > Programs for recently installed or otherwise suspicious programs?
Did you try the malware scanners?
None of the malware scanners detected anything. The Controll panel > Programs I've already done and uninstalled the programs in question, but their extensions still remain in regedit. So would it be okey to delete them now?
Which keys show up when you do a search in the registry editor?
Ɖɔɖɔɖo si wotia
Only this one: HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}