What causes the addition of an extension to have some form of leech overlayed with the big green "Start Now" button?
I was becoming quite furious with FireFox over the last six months when I finally tried running it with none of the10 or so extensions I normally was using. Since then it seems to have been running with little to no problems, just unfortunate that extensions on the official website corrupt the program. I have since added "Kee" and "Absolute Enable Right Click & Copy" and have continued running smooth.
Today I tried adding an old favorite "FoxClocks". Though it appears that the extension probably added on properly, the opening website screen for FoxClocks that in the tab reads "Thanks for installing FoxClocks! : https://foxclocks.org/extension-installed?client=Firefox&version=4.6.1 has an obnoxious big green overlaid "Start Now" button in the top area (see screenshot). I ran into this once before and was quite alarmed, and completely deleted FireFox from my computer, then did a re-install. I had not since encountered this scumware until now.
Does anyone know who is to blame for this garbage attempt to mislead people into installing garbage? Do we know what it is and how to get rid of it?
All Replies (15)
That looks like an add. Look to the right of that button.
Tracking Protection blocks these ads for me.
You can right-click and select "Inspect Element" to open the builtin Inspector with this element selected to see that these buttons are about.
You can set this pref to true on the about:config page to see more Tracking Protection choices in "Options/Preferences -> Privacy & Security".
- privacy.trackingprotection.ui.enabled
You can open the about:config page via the location/address bar. You can accept the warning and click "I accept the risk!" to continue.
I sure does, but I do not think the folks at Firefox would sanction it. Prior to these things infiltrating extensions was the underlying screen. This type of ad is highly deceptive and I see it as a strong breach of ethics due to its presentation as a part of the installation process, given that once one thinks that they are installing an extension this screen pops up with the extension name and a big "START" button at the top next to the official extension name. I find this highly misleading and if sanctioned by Firefox, unethical; it is therefore I believe it is a form of malware, whether my computer is infected, or the website is corrupted as I can't see Firefox deliberately acting unethically. This, of course, is my personal opinion-
Thank-you cor el also, will look into; however, I still see these as malware and sure would like to understand if FireFox is allowing this king of tactic or if somehow something krept onto my computer! If FireFox is actually allowing this, it will make a very quick decision as to staying with them or not (been with FF since beta 0.3)-
Modified by user1244385
https://addons.mozilla.org/en-US/firefox/addon/foxclocks/ The add-on is already installed, according to your system details.
What that screenshot shows is that it's coming from a browser hijacker : fromdoctopdf.com, malware that you will need to get rid of.
Go to the 3-bar menu (or 'Tools') => Addons => Extensions and look for any unfamiliar or suspicious looking extensions.
When you find any : remove them.
Do the same in your system's Control Panel.
However : most malware will be 'hiding' somewhere , so let's run malware scans :
Further information can be found in this article : https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-caused-malware?cache=no
Run most or all of the listed malware scanners. They all work differently - what one program doesn't pick up, the other might.
Thank-you Happy112.
Yes, FoxClocks is now installed and was at the time I wrote the initial post.
I'm afraid the only extensions shown are: Kee FoxClocks Absolute Enable Right Click & Copy
Control Panel: Programs and Features (my presumption of where you wanted me to go!): I am a little concerned that appnhost 1.0.5.1 shows in this display as it is supposed to be a Windows system file. It is shown as Published by Mixesoft Project. Other than that I have nothing else that I do not recognize.
Though I have Malwarebytes Premium constantly running with last scan as of 10 hours ago, I will re-scan, then I'll try another SpyBot scan and another AdWareCleaner, but I've been down this road before and nothing turned up. Wondering how it was hidden before and hope that the tools have now evolved over the last two months to be able to find it...
From what the screen shows it is coming from FoxClocks and no where else. Once you accept software installs the A/V or protection will not flagged it as malware or a Virus. That is what happens once a infection starts and the system knows nothing else.
bem@mccormick-associates.com said
I sure does, but I do not think the folks at Firefox would sanction it. Prior to these things infiltrating extensions was the underlying screen. This type of ad is highly deceptive and I see it as a strong breach of ethics due to its presentation as a part of the installation process, given that once one thinks that they are installing an extension this screen pops up with the extension name and a big "START" button at the top next to the official extension name. I find this highly misleading and if sanctioned by Firefox, unethical; it is therefore I believe it is a form of malware, whether my computer is infected, or the website is corrupted as I can't see Firefox deliberately acting unethically. This, of course, is my personal opinion-
1. In the Help menu you can use the Submit Feedback ... to let Mozilla know about that "Start" button and how you feel about it being a part of that post-installation notification page.
2. Use this website - https://discourse.mozilla-community.org/c/add-ons - to let the staff at the Addons website know about that "Thanks for installing FoxClocks!" webpage --- assuming that you installed that extension from the official Addon.Mozilla.Org website.
@ WestEnd: I sincerely apologize for any lack of clarity on my part; during the day I am wrestling with business issues, issues from my four daughters (including one who is about to leave for Study Abroad in Australia in 12 days and she just sprung on me that she needs new glasses and doesn't know how to handle several prescriptions going over there) and then the computer starts acting up, I get rather mixed up.
The "Start" button only appeared this time on the third and last extension I installed, which happened to be FoxClocks. On the prior fiasco in December when I was doing a re-installation with synch turned on (it isn't any more) and synch started loading 10 to 15 extensions from my profile, that idiot thing started popping up screen after screen and I do not know what triggered it, only that then was the first time I ever encountered it.
@the-edmeister: Do you really think this is a sanctioned web page behavior? Happy112 stated:
What that screenshot shows is that it's coming from a browser hijacker : fromdoctopdf.com, malware that you will need to get rid of.
I definitely recall that when I saw this before the exact same format pushed software of at least several titles, and I really, really can't believe that it is sanctioned by FireFox. Heck, if i find out it is i am dumping FireFox immediately, though I still find it to be the best I have used.
WestEnd said
From what the screen shows it is coming from FoxClocks and no where else.
Like I said before : it's coming from fromdoctopdf.com - a browser hijacker.
Modified by Happy112
@Happy112 - I am taking you seriously, which is why I left this computer alone last nite as Malwarebytes ran a 7 hour scan on it! Nothing turned up on it, and then our friends at MS screwed with me with updates and restarts, most if not all as reported this morning failed to install, and soon going to move into SpyBot, Hitman Pro, AdWareCleaner, RogueKiller, probably run an online scan from Eset or the like, ... I will advise back regardless of what i find or don't find-
@ brucemc777 :
You take all the time you need !
Question : Do you use Sync ?
I just found out that there is someone with the exact same username, who already found out about this being the work of fromdoctopdf.com in December :
https://forums.malwarebytes.com/topic/217223-infected-behavior-on-new-firefox-installation/
That was my first encounter, but I do not think I had found this thing to be the answer. After running every scan I possibly could tolerate back then and all reporting nothing at all I gave up, wiped the installation clean, reinstalled FF and did not install any extensions whatsoever. Then I eventually installed the first two I mentioned - Kee and Absolute Right Click with no signs of formdoctopdf (at least none that I noticed. As also mentioned, I have a lot going on and get distracted fairly easily). Only when I installed FoxClocks recently did I notice that dang thing again, so I had hoped I hit upon some clue as to how it was creeping onto my system or where the heck it is hiding. Running roughly 6 or 7 full scans is time consuming, especially as this is my main work computer, and when they all report that nothing is wrong it becomes rather frustrating!
I appreciate you hanging in there with me as I try to route this obnoxious scumware out!!!
Again : you take all the time you need !
Just curious about your answer to my question : Do you use Sync ?
See the last post here :
https://forums.malwarebytes.com/topic/217223-infected-behavior-on-new-firefox-installation/
Normally I did use Sync, but after that December mess and on the advice of one of the people trying to help me, I killed it and have not re-engaged it to date.
brucemc777 said
I sure does, but I do not think the folks at Firefox would sanction it. Prior to these things infiltrating extensions was the underlying screen. This type of ad is highly deceptive and I see it as a strong breach of ethics due to its presentation as a part of the installation process, given that once one thinks that they are installing an extension this screen pops up with the extension name and a big "START" button at the top next to the official extension name. I find this highly misleading and if sanctioned by Firefox, unethical; it is therefore I believe it is a form of malware, whether my computer is infected, or the website is corrupted as I can't see Firefox deliberately acting unethically. This, of course, is my personal opinion- Thank-you cor el also, will look into; however, I still see these as malware and sure would like to understand if FireFox is allowing this king of tactic or if somehow something krept onto my computer! If FireFox is actually allowing this, it will make a very quick decision as to staying with them or not (been with FF since beta 0.3)-
How can a web browser sanction anything as Mozilla is the company that makes the browser we know as Firefox. if you really have been with the browser since Phoenix 0.3 then you would know this.
The foxclocks.org is the extension author homepage as you can see on https://addons.mozilla.org/firefox/addon/foxclocks/
The big green start button on the page you are complaining about is just a Google Ad and may be used to help pay for the costs of the website and in making and providing this extension for other Firefox users to use. You do not need to click on these Ads. Extension authors do not get paid by Mozilla to make the extensions.
It is not uncommon for extension authors to have their own web sites for their Extension(s) for additional information, faq, support, source files etc.
The majority of Extensions being hosted on addons.mozilla.org are made by a third-party author or company as most of Mozilla's own extensions are listed by say https://addons.mozilla.org/firefox/user/mozilla/
Modified by James