I think the versions from the Mozilla Add-ons site are signed:

• https://addons.mozilla.org/firefox/addon/tab-mix-plus/
• https://addons.mozilla.org/firefox/addon/adblock-plus/

However, I'm not sure how to verify that.

Most add-ons are signed, but it looks like those two are among those extensions that aren't signed yet. Not a big deal yet, as Firefox 40 isn;t due to be released until 08-11 and signing isn't mandatory for Firefox 40, a warning will appear not a block.

That extensions do not have "-signed" in the name doesn't mean that they aren't signed. You can check that by opening the XPI file (ZIP archive) by the presence of the META-INF folder that stores the signing information. When signing got enabled then all extensions that weren't signed at that time got an updated signed version and got ".1-signed" to distinguish them from their unsigned version. This wasn't needed for extensions that were already signed. Extensions that got updated and previously had "-signed" no longer require a special signed version and thus do not need a new name that includes -signed.

AFAIK then Adblock Plus has been signed for quite a few years and thus hadn't require a minor update to a signed version. You can also see this with an extension like NoScript that also lacks the signed in its name and that probably has been signed before or otherwise has been updated.

I'm looking for signed Tab Mix Plus and AdBlock due to the following problem. The answer was that it is caused by unsigned extension making "back door".

My Firefox on Win 8.1 crashes from time to time, and install some unwanted Addon,and deletes all existing useful Addons at the same time, though xpinstall.enabled is set to false in about:config.The unwanted addon which suddenly appears is mostly some advertise component or virus.It is not always the same one, and also I do not browse through unsafe pages, only wikipedia,youtube,facebook and some tex and pdf pages. I have these 3 addons: Adblock Plus Tab mix plus Start Up master

how do I 100% prevent any new addons to be installed without asking me?? I have every component plugins(Flash),Firefiox,Addons,etc. up to date, so no security problem should occur. Thank you, Max

cor-el said

That extensions do not have "-signed" in the name doesn't mean that they aren't signed. You can check that by opening the XPI file (ZIP archive) by the presence of the META-INF folder that stores the signing information. When signing got enabled then all extensions that weren't signed at that time got an updated signed version and got ".1-signed" to distinguish them from their unsigned version. This wasn't needed for extensions that were already signed. Extensions that got updated and previously had "-signed" no longer require a special signed version and thus do not need a new name that includes -signed.

I cannot find this folder. What is the exact path to the folder?

Do you have a ZIP viewing program, either a paid one like WinZip or a free one like 7-zip?

If you right-click the install button on the Add-ons site and download the file to a convenient location, you then can open the .xpi file with your zip viewer and see a handful of files and top-level folders inside. This is where the META-INF folder should appear.

I'm attaching what i see for Adblock Plus. I didn't try to open/view the files in that folder.

Backing up to your malware issue...

A future version of Firefox will have the feature to disable unsigned extensions. I don't think there is any way to do that in Firefox 39, and I'm not sure it's possible in Firefox 40 (due out in less than two weeks).

Assuming the vector is not a vulnerable plugin, I suspect there is some other software on your system pushing those shape-shifting extensions into Firefox. I'm not sure what cleanup efforts you have made so far, so I'll give you my standard advice...

Since you are already familiar with the Add-ons page, I suggest these additional actions:

(1) Open the Windows Control Panel, Uninstall a Program. After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help surface undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it. Take out as much trash as possible here.

(2) Scan for remaining troublesome programs with the scanning/cleaning tools listed in our support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.

(3) Clear potentially malicious files from Firefox's program folder using:

Clean Reinstall

We use this name, but it's not about removing your settings, it's about making sure the program files are clean (no inconsistent, corrupted, or alien code files). As described below, this process does not disturb your existing settings. Do NOT uninstall Firefox, that's not needed.

(A) Download a fresh installer for Firefox 39.0 from https://www.mozilla.org/firefox/all/ to a convenient location. (Scroll down to your preferred language.)

(B) Exit out of Firefox (if applicable).

(C) Rename the program folder, either:

(64-bit Windows folder names)

C:\Program Files (x86)\Mozilla Firefox

to

C:\Program Files (x86)\OldFirefox

(32-bit Windows folder names)

C:\Program Files\Mozilla Firefox

to

C:\Program Files\OldFirefox

(D) Run the installer you downloaded in #1. It should automatically connect to your existing settings.

Any improvement after this reinstall?

Note: Some plugins may exist only in that OldFirefox folder. If something essential is missing, look in these folders:

• \OldFirefox\Plugins
• \OldFirefox\browser\plugins

(4) Remove any user.js file in your profile folder. You can access that folder while Firefox is closed by pasting the following into the Start menu search box and pressing Enter:

%APPDATA%\Mozilla\Firefox\Profiles

Here you should find one or more semi-randomly-named folders. Click into each and check for a file named user.js and unless you created it yourself, delete it.

Note: by default, Windows hides the .js file extension. To work with files accurately, I suggest setting Windows to show all file extensions. This article has the steps: http://windows.microsoft.com/en-us/windows/show-hide-file-name-extensions

Are things better?

Thank you for your detailed advice. I somehow did all these steps recently,including the date relevant last installations for possible viruses but I didn't detect any problem.

The crashing of Firefox occurs only several times a week, so it is possible for me to manually repair it,which is of course not very pleasant.

However I have two directions where to look what is wrong: one page writes at the top, Shockwave flash has crashed. But also this plugin is downloaded from Adobe, so it should not be vulnerable or contain bugs.

The best solution to what exactly happens is to send you a kind of CRASH REPORT, but I don't know where such a log file is found in the Mozilla's directory. This is because after addware is installed and other useful addons are deleted,Firefox crashes.

Thank you for your patience

You can check for problems with current Shockwave Flash plugin versions and try this:

• make sure you have the latest Flash version:
  http://www.adobe.com/special/products/flashplayer/fp_distribution3.html
• check for updates for your graphics drive drivers
  https://support.mozilla.org/kb/upgrade-graphics-drivers-use-hardware-acceleration
• disable protected mode in the Flash plugin (Flash 11.3+ on Windows Vista and later)
• disable hardware acceleration in the Flash plugin
• disable hardware acceleration in Firefox

See also:

• http://kb.mozillazine.org/Flash#Troubleshooting

How do I do the last 3 items,to disable protected mode,and acceleration? Thank you

You can read the details in the linked mozillaZine knowledge base article.

• http://kb.mozillazine.org/Flash#Troubleshooting

• How do I disable or enable hardware acceleration?
  https://forums.adobe.com/thread/891337
• https://helpx.adobe.com/flash-player/kb/video-playback-issues.html

Flash "Display settings" window:

• http://www.macromedia.com/support/documentation/en/flashplayer/help/help01.html

In Windows Vista and Windows 7 and later you can toggle this pref to true on the about:config page to disable protected mode in the Shockwave Flash plugin, so it is no longer needed to modify the mms.cfg file in Firefox 36 and later.

• dom.ipc.plugins.flash.disable-protected-mode = true

You can open the about:config page via the location/address bar. You can accept the warning and click "I'll be careful" to continue.

• http://kb.mozillazine.org/about:config

cor-el said

You can read the details in the linked mozillaZine knowledge base article.

• http://kb.mozillazine.org/Flash#Troubleshooting

• How do I disable or enable hardware acceleration?
  https://forums.adobe.com/thread/891337
• https://helpx.adobe.com/flash-player/kb/video-playback-issues.html

Flash "Display settings" window:

• http://www.macromedia.com/support/documentation/en/flashplayer/help/help01.html

In Windows Vista and Windows 7 and later you can toggle this pref to true on the about:config page to disable protected mode in the Shockwave Flash plugin, so it is no longer needed to modify the mms.cfg file in Firefox 36 and later.

• dom.ipc.plugins.flash.disable-protected-mode = true

You can open the about:config page via the location/address bar. You can accept the warning and click "I'll be careful" to continue.

• http://kb.mozillazine.org/about:config

I wonder why acceleration issues would cause adding addware...?

max2 said

However I have two directions where to look what is wrong: one page writes at the top, Shockwave flash has crashed. But also this plugin is downloaded from Adobe, so it should not be vulnerable or contain bugs.

All complex software has bugs... but it's also the case that there is some complicated juggling between Firefox and a plugin, passing content and commands back and forth, so sometimes problem are related to that interaction.

Regarding protected mode, I just accidentally discovered today that there is now a checkbox accessible through the Add-ons page to disable it, as described in this article: Adobe Flash protected mode in Firefox.

I did all the steps above,but today I got installed "GrreatSave4u 2.3" and got deleted all other useful addons.

xpinstall.enabled was set to false. How do I protect my browser permanently? Is there any flag in about:config to do this?

Which page is responsible for this? I have only oppened Local time page in CR,email,Facebook,badoo,wikipedia,youtube

Did your Firefox do a Refresh? The telltale sign is an Old Firefox Data folder on the desktop with a freshly updated, semi-randomly-named folder inside.

If this occurred without a Refresh, I suspect you have lingering malware. You may want to try the forums listed in our support article "Troubleshoot Firefox issues caused by malware" where moderators can lead you through the use of advanced diagnostic and clean-up tools.

THIS Troubleshoot link has seemingly solved my problem. I found something named TABS UP file in C disk,and since its deletion the problem didn't reappeared.

As an expert,can I ask you if there is an extension for Firefox which automatically closes "over" windows with adds?I have addblocker but these windows are to be closed manually so far...:-(

Sounds like an improvement!

Do you use Adblock Plus? There is a supplemental extension named Adblock Plus Pop-up Addon that you can train one pop-up at a time not to allow that window again. I haven't tried it myself.

https://addons.mozilla.org/firefox/addon/adblock-plus-pop-up-addon/

Oh, this adblock-plus-pop-up does not work properly Try to install it and see this page

http://www.nudavpraci.sk/vtipy/dvaja-kamarati-a-slon/

After learning it,this page however still displays the ADDS wihtin about 1 minute again.

I looked at that page with scripts disabled, so I didn't experience the full joy of what it does. I noticed in the code that it uses something called Yeloni exit popups from this company: http://www.yeloni.com/ Maybe those can bypass a popup blocker. You could bring it to the attention of the add-on author to see whether they can handle them.