adware "r.svrtrack.com" - Windows Malware Removal Help ...

The MalwareBytes thread implied that the popup was actually functioning as an add-on or extension, and suggested that I uninstall Firefox to make it go away.

It may come down to that, but I have many years of settings & notes in FF that may be lost. The MBytes step-by-step removal instructions included making a backup of the Bookmarks. But I'm not confident that it will save my notes in the Properties box.

Anyway, the nuisance popup seems to be doing a Re-direct, which should be noticed by Antivirus as suspicious behavior. But Avast apparently thinks it's a normal Firefox function.

Since I haven't knowingly downloaded or enabled any Add-Ons in many months, how could a "monetization" extension get into the system?

Firefox comes in two or more folders on all computers. They are;

Maintenance: (Programs Folder) <Windows Only> Firefox itself: (Programs Folder) And two folders in the profile of each user on the computer for each Firefox profile for that user.

If you remove the Firefox folder, the user profiles would not be affected.

Fred

Thanks for the info. Can I manually delete the Program folder, then download a new installer, and expect it to incorporate the old Profile folder?

Since Support indicated that the popup window was an actual Mozilla Extension function, I looked again at my list of Add-ons. I deleted the most recent Add-on, a text highlighter, but that didn't make any difference.

I'm currently running FF in Safe Mode, with Add-ons disabled. Now the pop-ups don't pop. So the source of the problem does indeed seem to be in the Extensions. But I haven't added any recently, so why would the popup suddenly appear? Maybe due to an automatic update?

If I can reinstall FF without losing years of bookmarks & notes, that might be the only solution.

FredMcD said

Firefox comes in two or more folders on all computers.

Under AddOns/Plug-ins I noticed that Shockwave Flash had been updated on Nov 20. That's about the time the popups started popping. But I don't find any option to Remove or Disable that plugin. I have the Open H264 add-on, which I understand is similar to Flash. So I'd like to try deleting the Flash plugin, if I can find a way to do it.

PS___I uninstalled FlashPlayer from my PC using Control Panel. When I reopen FF, Shockwave Flash no longer appears in the list of PlugIns. However, the "moz-extension" popups are still popping. So, my next step will be to uninstall Firefox and hope for the best.

Shockwave Flash is the old name for the NPAPI Flash Player Plugin from Adobe.

NPAPI Plugins are not installed in Firefox like Extensions are but on the OS and Firefox makes use of it. You can type about:plugins to see where it is.

The Flash Player is the only NPAPI Plugin allowed to run in Firefox now days. https://support.mozilla.org/en-US/kb/npapi-plugins

I doubt the malware problem is directly due to the Flash Plugin. However if you were not careful when you downloaded Flash from Adobe site then you can download extras if not unchecked before download (Windows only).

James

Thanks for the info. The Flash Plugin was added (not by me) on the same day that the latest FF update was installed. It was about that time the popups started. Flash has a reputation for harboring malware, so I was suspicious. Anyway, I was using the HTML5 video add-on as an alternative. I have uninstalled Adobe Flash from Control Panel.

I have just now uninstalled and reinstalled FF. At the moment it has zero add-ons. Tomorrow, I'll add the same ones as before, one at a time, and watch for any malware activity.

If the "moz-extension" popup wasn't a part of Flash, I have no clue were it was located or how it got on my computer. Several days of virus & malware searches, plus forum support, couldn't find the source. So I'm keeping my fingers crossed.

It’s very sad, but many software downloaders/ installers will trick you into installing not only their program, but other programs as well.

You have heard of the fine print in shady contracts, right? Well, some installers you need to look at the itsy bitsy teeny weeny fine print.

You are thinking you are giving the installer permission to install the program you want by using the recommended option. But if you use the Manual Option Instead, you discover all kinds of stuff that you do not even know what it is or what it does.

From now on, everyone needs to Use The Manual Option to put a stop to this.

Note that these programs can also change browser/computer settings.

johnearthlink said

Thanks for the info. The Flash Plugin was added (not by me) on the same day that the latest FF update was installed. It was about that time the popups started. Flash has a reputation for harboring malware, so I was suspicious. Anyway, I was using the HTML5 video add-on as an alternative.

No version of desktop Firefox download or update for Windows, Mac OSX or Linux from Mozilla.org comes with the proprietary Flash Player Plugin from Adobe. So the Firefox web browser did not add Flash.

HTML5 video add-on as in one of the HTML5 Youtube related Extensions from addons.mozilla.org?

Those extensions can cause problems on Youtube and Youtube has been using HTML5 player on site by default for a few years now and not using the Flash Player Plugin anymore. https://www.youtube.com/html5/

johnearthlink said

I have the Open H264 add-on, which I understand is similar to Flash.

No it is not similar nor a replacement nor is it used for HTML5 players as it is to enable video calls with devices that require the H.264 codec. https://support.mozilla.org/en-US/kb/open-h264-plugin-firefox

also the official abbreviation is actually Fx

"No it is not similar nor a replacement nor is it used for HTML5 players as it is to enable video calls with devices that require the H.264 codec."

Ooops! I copied the wrong extension name from my notes. I intended to say that I had installed "HTML5 Video Everywhere" as a replacement for Flash. I removed Flash from my computer several years ago, due to some problems that experts attributed to Flash. Since then, I have avoided Flash. So, unless it came in with the latest FF update, I have no idea where it came from. Is it just a coincidence that the Flash file has the same date as the FF update?

In any case, the popups continued after I removed Flash from Add-ons. Now, after re-installing FF, with no extensions, no popups. I'll add them back in, one at a time. But the few extensions I had were not causing any problems until the latest FF update.

Prior to the popup problem, other than Flash, the only extensions I had were : AdBlock Plus Avast Online Security HTML Video Everywhere PDF Creator.

Of those, the prime suspect might be the PDF Creator, since it seems to be a one-man operation, thus more easily hacked. Yet again, no popups until the FF update a week ago. I'd hate to remove it, because I use it a lot, and haven't found a substitute.

Problem Solved

Uninstalled Firefox. Installed new copy of same version. Started with no extensions. Added one new extension each day. UBlock instead of AdBlockPlus. HTML5 Video Everywhere. No replacement for FlashBlockPlus. PDF Print & Save instead of PDF Creator.

After 4 days, no more popups titled "moz-extensions". Still don't know what to blame for popups. But PDF Creator is my prime suspect.

That was very good work. Well done.