Home | Blog | Software | Reviews and Features | Forum | Help | Donate | About us
topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • December 08, 2016, 09:50:31 PM
  • Proudly celebrating 10 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: Are the new Firefox versions coming with adware built in?  (Read 3572 times)

superboyac

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 6,070
  • Is your software in my list?
    • View Profile
    • Donate to Member
Are the new Firefox versions coming with adware built in?
« on: December 12, 2012, 08:43:31 PM »
I noticed recently that I've been getting these "coupondropdown" ads every once in a while, like so:
Screenshot - 12_12_2012 , 6_36_36 PM.png

Before I try to blast with all the tools, I was wondering if this was built into the new firefox versions?  Because I normally never get any ads or anything, and the only changes lately have been the firefox updates.  I see them in wikipedia occasionally as well.

TaoPhoenix

  • Supporting Member
  • Joined in 2011
  • **
  • Posts: 4,550
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #1 on: December 12, 2012, 09:27:04 PM »
It's not clear. Before I power-bombed it with About:Config, at one point when I had the command wrong, making new tabs dropped me onto some Spanish page. It's like some weird defaults crept in there and were only hidden for so long by more powerful default behavior.

Summary: So I don't really think those ads are in FF proper, I watch Slashdot daily and that's the kind of thing they wouldn't stand for without an article. I'm more likely to believe ever sneakier BHO (Browser Helper Objects) and other stuff sneaking in there because you didn't scroll down to unclick a box when you installed something, but then you don't see it for a while because some other setting is over-riding it, until some random version of FF (see my other rant) breaks something and then the hidden ad pops up.


superboyac

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 6,070
  • Is your software in my list?
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #2 on: December 12, 2012, 10:44:18 PM »
Thanks TP, I'll investigate.  Speaking of which, now you're doing it to me also?!  Cmon man, I thought we were friends!  ;D
Screenshot - 12_12_2012 , 8_42_33 PM.png

TaoPhoenix

  • Supporting Member
  • Joined in 2011
  • **
  • Posts: 4,550
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #3 on: December 12, 2012, 11:25:08 PM »
Thanks TP, I'll investigate.  Speaking of which, now you're doing it to me also?!  Cmon man, I thought we were friends!  ;D

Doing what to you?! There's a gender problem in that pic! That would mean not only was I kidnapped to Mexico but that I didn't even notice the results of the operation!  :o

Edit: No really, that's not basic FF, that screams malware glued itself into your browser instance. You might have a good hour of detective work ahead of you! :(

Curt

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 7,092
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #4 on: December 13, 2012, 01:54:01 AM »
1) http://coupondropdown.com/uninstall.php
2) http://www.onlinesaf...ser-hijacker-malware

Quote from: onlinesafety411
DIY CouponDropdown removal resources
http://www.onlinesaf...ser-hijacker-malware

*If you are an experienced computer user, you may locate and delete the CouponDropdown files and registry entries below. The manual removal process for CouponDropdown is best performed while in Safe Mode.

CouponDropdown Files

    %LocalAppData%\CouponDropDown\
    %LocalAppData%\CouponDropDown\Chrome\
    %LocalAppData%\CouponDropDown\Chrome\CouponDropDown.crx
    %ProgramFilesX86%\CouponDropDown\
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.dll
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.exe
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.ico
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.ini
    %ProgramFilesX86%\CouponDropDown\CouponDropDownGui.exe
    %ProgramFilesX86%\CouponDropDown\CouponDropDownInstaller.log
    %ProgramFilesX86%\CouponDropDown\Uninstall.exe

CouponDropdown Registry Entries

    HKEY_CURRENT_USER\Software\AppDataLow\Software\CouponDropDown\
    HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider
    HKEY_CURRENT_USER\Software\Cr_Installer
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.BHO
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.FBApi
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.Sandbox
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055435552}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066436652}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077437752}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11111111-1111-1111-1111-110011431152}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22222222-2222-2222-2222-220022432252}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33333333-3333-3333-3333-330033433352}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550055435552}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660066436652}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77777777-7777-7777-7777-770077437752}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440044434452}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110011431152}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022432252}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33333333-3333-3333-3333-330033433352}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550055435552}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066436652}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{77777777-7777-7777-7777-770077437752}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\New Windows\Allow\*.crossrider.com
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011431152}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CouponDropDown
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011431152}


IainB

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 6,141
  • Slartibartfarst
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #5 on: December 13, 2012, 02:08:01 AM »
@superboyac: Yes, it looks like it's probably on your PC. If you don't want to manually fix it per @Curt's comment, then I'd suggest you run Malwarebytes (free version will do) over your PC, plus a virus check on the whole disk. That should fix it.

By the way, some malware/viruses I have come across on infected PCs had effectively stopped/disabled firewalls and the running of virus/malware checkers, and even editing of the Registry. To save time/trouble, I usually remove the infected drive and use MBAM and then a virus checker to clean it as a slave drive to a clean PC.

f0dder

  • Charter Honorary Member
  • Joined in 2005
  • ***
  • Posts: 9,029
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #6 on: December 13, 2012, 03:42:20 AM »
superboy, do you ever visit any of those "click LIKE to watch this {movie, picture, whatever}" facebook sites? Prime way to get malware on your box. Had to clean up two of my brothers' PCs last weekend, I'm pretty sure that's how they got crap on their system (neither of them download warez, and at least the youngest of them doesn't watch pr0n). The malware had even disabled AdBlockPlus and Ghostery both in Chrome and FireFox.

Attacks can also happen totally automated from drive-by attacks, of course, and you don't even need to visit seedy sites, a single compromised banner-ad server is enough. AdBlockPlus+NoScript+Ghostery ftw... oh, and not having Java, Flash or AdobePDF plugins in your browser.
- carpe noctem

superboyac

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 6,070
  • Is your software in my list?
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #7 on: December 13, 2012, 09:11:17 AM »
superboy, do you ever visit any of those "click LIKE to watch this {movie, picture, whatever}" facebook sites? Prime way to get malware on your box. Had to clean up two of my brothers' PCs last weekend, I'm pretty sure that's how they got crap on their system (neither of them download warez, and at least the youngest of them doesn't watch pr0n). The malware had even disabled AdBlockPlus and Ghostery both in Chrome and FireFox.

Attacks can also happen totally automated from drive-by attacks, of course, and you don't even need to visit seedy sites, a single compromised banner-ad server is enough. AdBlockPlus+NoScript+Ghostery ftw... oh, and not having Java, Flash or AdobePDF plugins in your browser.
It's possible, I don't know.  Just never happened before.  I use ad muncher, ad block, MSE.  I don't know if I can get away with no java or flash...wouldn't you have a difficult time seeing multimedia on the websites?

f0dder

  • Charter Honorary Member
  • Joined in 2005
  • ***
  • Posts: 9,029
  • [Well, THAT escalated quickly!]
    • View Profile
    • f0dder's place
    • Read more about this member.
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #8 on: December 13, 2012, 09:26:48 AM »
It's possible, I don't know.  Just never happened before.  I use ad muncher, ad block, MSE.
AFAIK MSE only scans executables - so if you get exploited by something that does direct process injection and never drops anything, it probably won't help. EMET helps mitigating against exploits.

I don't know if I can get away with no java or flash...wouldn't you have a difficult time seeing multimedia on the websites?
When I need flash, I fire up chrome for that particular site (I've also got ABP and Ghostery in Chrome, as well as "click to play" enabled for against plugins). When I need browser Java, which is exclusively for the national digital signature single-sign-on crap, I launch a virtual machine for that specific purpose. PDFs are always downloaded and viewed with an external program (Foxit or Sumatra).

Sure, it's a minor annoyance doing it this way, but considering the amount of exploit vectors it eliminates, it's well worth it.
- carpe noctem

superboyac

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 6,070
  • Is your software in my list?
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #9 on: December 13, 2012, 09:50:00 AM »
^^I like your style.  Will experiment...

TaoPhoenix

  • Supporting Member
  • Joined in 2011
  • **
  • Posts: 4,550
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #10 on: December 13, 2012, 10:53:35 AM »
^^I like your style.  Will experiment...

Obligatory
"Superboy Style"

superboyac

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 6,070
  • Is your software in my list?
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #11 on: December 13, 2012, 12:30:47 PM »

MilesAhead

  • Supporting Member
  • Joined in 2009
  • **
  • Posts: 7,288
    • View Profile
    • Miles Ahead Software
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #12 on: December 13, 2012, 03:32:21 PM »
Quote
Are the new Firefox versions coming with adware built in?

All I wanna' know is, where can I buy one?


cranioscopical

  • Friend of the Site
  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 4,368
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #13 on: December 13, 2012, 06:31:52 PM »
All I wanna' know is, where can I buy one?
Act fast and you can pick one up cheaply at the FireFox sale.

MilesAhead

  • Supporting Member
  • Joined in 2009
  • **
  • Posts: 7,288
    • View Profile
    • Miles Ahead Software
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #14 on: December 13, 2012, 09:25:03 PM »
All I wanna' know is, where can I buy one?
Act fast and you can pick one up cheaply at the FireFox sale.

I hope I don't have to camp out. I don't have wifi. It would be serious Internet Withdrawal or a cash advance.. or sumpthin' :)

Curt

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 7,092
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #15 on: December 17, 2012, 04:14:21 PM »
I use Video DownloadHelper, but have not seen this before:

5766206889512879973.png

Did you maybe get it from there?

superboyac

  • Charter Member
  • Joined in 2005
  • ***
  • Posts: 6,070
  • Is your software in my list?
    • View Profile
    • Donate to Member
Re: Are the new Firefox versions coming with adware built in?
« Reply #16 on: December 17, 2012, 10:08:08 PM »
I use Video DownloadHelper, but have not seen this before:
 (see attachment in previous post)
Did you maybe get it from there?

Not really sure...I actually reinstalled Windows this weekend!  lol...overreaction possibly.