Are the new Firefox versions coming with adware built in?

[superboyac]

I noticed recently that I've been getting these "coupondropdown" ads every once in a while, like so:


Before I try to blast with all the tools, I was wondering if this was built into the new firefox versions?  Because I normally never get any ads or anything, and the only changes lately have been the firefox updates.  I see them in wikipedia occasionally as well.

[TaoPhoenix]

It's not clear. Before I power-bombed it with About:Config, at one point when I had the command wrong, making new tabs dropped me onto some Spanish page. It's like some weird defaults crept in there and were only hidden for so long by more powerful default behavior.

Summary: So I don't really think those ads are in FF proper, I watch Slashdot daily and that's the kind of thing they wouldn't stand for without an article. I'm more likely to believe ever sneakier BHO (Browser Helper Objects) and other stuff sneaking in there because you didn't scroll down to unclick a box when you installed something, but then you don't see it for a while because some other setting is over-riding it, until some random version of FF (see my other rant) breaks something and then the hidden ad pops up.

[superboyac]

Thanks TP, I'll investigate.  Speaking of which, now you're doing it to me also?!  Cmon man, I thought we were friends! 

[TaoPhoenix]

Thanks TP, I'll investigate.  Speaking of which, now you're doing it to me also?!  Cmon man, I thought we were friends!  

-superboyac (December 12, 2012, 10:44 PM)

Doing what to you?! There's a gender problem in that pic! That would mean not only was I kidnapped to Mexico but that I didn't even notice the results of the operation!  

Edit: No really, that's not basic FF, that screams malware glued itself into your browser instance. You might have a good hour of detective work ahead of you!

[Curt]

1) http://coupondropdown.com/uninstall.php
2) http://www.onlinesaf...ser-hijacker-malware

DIY CouponDropdown removal resources
http://www.onlinesaf...ser-hijacker-malware

*If you are an experienced computer user, you may locate and delete the CouponDropdown files and registry entries below. The manual removal process for CouponDropdown is best performed while in Safe Mode.

CouponDropdown Files

    %LocalAppData%\CouponDropDown\
    %LocalAppData%\CouponDropDown\Chrome\
    %LocalAppData%\CouponDropDown\Chrome\CouponDropDown.crx
    %ProgramFilesX86%\CouponDropDown\
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.dll
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.exe
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.ico
    %ProgramFilesX86%\CouponDropDown\CouponDropDown.ini
    %ProgramFilesX86%\CouponDropDown\CouponDropDownGui.exe
    %ProgramFilesX86%\CouponDropDown\CouponDropDownInstaller.log
    %ProgramFilesX86%\CouponDropDown\Uninstall.exe

CouponDropdown Registry Entries

    HKEY_CURRENT_USER\Software\AppDataLow\Software\CouponDropDown\
    HKEY_CURRENT_USER\Software\AppDataLow\Software\Crossrider
    HKEY_CURRENT_USER\Software\Cr_Installer
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.BHO
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.FBApi
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CrossriderApp0004352.Sandbox
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055435552}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066436652}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077437752}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{11111111-1111-1111-1111-110011431152}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{22222222-2222-2222-2222-220022432252}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33333333-3333-3333-3333-330033433352}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550055435552}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660066436652}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77777777-7777-7777-7777-770077437752}
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440044434452}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{11111111-1111-1111-1111-110011431152}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{22222222-2222-2222-2222-220022432252}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{33333333-3333-3333-3333-330033433352}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{55555555-5555-5555-5555-550055435552}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{66666666-6666-6666-6666-660066436652}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\Interface\{77777777-7777-7777-7777-770077437752}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{44444444-4444-4444-4444-440044434452}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\New Windows\Allow\*.crossrider.com
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011431152}
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CouponDropDown
    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011431152}

-onlinesafety411

[IainB]

@superboyac: Yes, it looks like it's probably on your PC. If you don't want to manually fix it per @Curt's comment, then I'd suggest you run Malwarebytes (free version will do) over your PC, plus a virus check on the whole disk. That should fix it.

By the way, some malware/viruses I have come across on infected PCs had effectively stopped/disabled firewalls and the running of virus/malware checkers, and even editing of the Registry. To save time/trouble, I usually remove the infected drive and use MBAM and then a virus checker to clean it as a slave drive to a clean PC.

[f0dder]

superboy, do you ever visit any of those "click LIKE to watch this {movie, picture, whatever}" facebook sites? Prime way to get malware on your box. Had to clean up two of my brothers' PCs last weekend, I'm pretty sure that's how they got crap on their system (neither of them download warez, and at least the youngest of them doesn't watch pr0n). The malware had even disabled AdBlockPlus and Ghostery both in Chrome and FireFox.

Attacks can also happen totally automated from drive-by attacks, of course, and you don't even need to visit seedy sites, a single compromised banner-ad server is enough. AdBlockPlus+NoScript+Ghostery ftw... oh, and not having Java, Flash or AdobePDF plugins in your browser.

[superboyac]

superboy, do you ever visit any of those "click LIKE to watch this {movie, picture, whatever}" facebook sites? Prime way to get malware on your box. Had to clean up two of my brothers' PCs last weekend, I'm pretty sure that's how they got crap on their system (neither of them download warez, and at least the youngest of them doesn't watch pr0n). The malware had even disabled AdBlockPlus and Ghostery both in Chrome and FireFox.

Attacks can also happen totally automated from drive-by attacks, of course, and you don't even need to visit seedy sites, a single compromised banner-ad server is enough. AdBlockPlus+NoScript+Ghostery ftw... oh, and not having Java, Flash or AdobePDF plugins in your browser.

-f0dder (December 13, 2012, 03:42 AM)

It's possible, I don't know.  Just never happened before.  I use ad muncher, ad block, MSE.  I don't know if I can get away with no java or flash...wouldn't you have a difficult time seeing multimedia on the websites?

[f0dder]

It's possible, I don't know.  Just never happened before.  I use ad muncher, ad block, MSE.

-superboyac (December 13, 2012, 09:11 AM)

AFAIK MSE only scans executables - so if you get exploited by something that does direct process injection and never drops anything, it probably won't help. EMET helps mitigating against exploits.

I don't know if I can get away with no java or flash...wouldn't you have a difficult time seeing multimedia on the websites?

-superboyac (December 13, 2012, 09:11 AM)

When I need flash, I fire up chrome for that particular site (I've also got ABP and Ghostery in Chrome, as well as "click to play" enabled for against plugins). When I need browser Java, which is exclusively for the national digital signature single-sign-on crap, I launch a virtual machine for that specific purpose. PDFs are always downloaded and viewed with an external program (Foxit or Sumatra).

Sure, it's a minor annoyance doing it this way, but considering the amount of exploit vectors it eliminates, it's well worth it.

[superboyac]

^^I like your style.  Will experiment...

[TaoPhoenix]

^^I like your style.  Will experiment...

-superboyac (December 13, 2012, 09:50 AM)

Obligatory
"Superboy Style"

[superboyac]

[MilesAhead]

Are the new Firefox versions coming with adware built in?

All I wanna' know is, where can I buy one?

[cranioscopical]

All I wanna' know is, where can I buy one?

-MilesAhead (December 13, 2012, 03:32 PM)

Act fast and you can pick one up cheaply at the FireFox sale.

[MilesAhead]

All I wanna' know is, where can I buy one?

-MilesAhead (December 13, 2012, 03:32 PM)

Act fast and you can pick one up cheaply at the FireFox sale.

-cranioscopical (December 13, 2012, 06:31 PM)

I hope I don't have to camp out. I don't have wifi. It would be serious Internet Withdrawal or a cash advance.. or sumpthin'

[Curt]

I use Video DownloadHelper, but have not seen this before:



Did you maybe get it from there?

[superboyac]

I use Video DownloadHelper, but have not seen this before:
 (see attachment in previous post)
Did you maybe get it from there?

-Curt (December 17, 2012, 04:14 PM)

Not really sure...I actually reinstalled Windows this weekend!  lol...overreaction possibly.