Eheka Pytyvõha

Emboyke pytyvõha apovai. Ndorojeruremo’ãi ehenói térã eñe’ẽmondóvo pumbyrýpe ha emoherakuãvo marandu nemba’etéva. Emombe’u tembiapo imarãkuaáva ko “Marandu iñañáva” rupive.

Kuaave

Random add-ons that installs itself on firefox and google chrome without my consent

  • 15 Mbohovái
  • 18 oguereko ko apañuãi
  • 33 Hecha
  • Mbohovái ipaháva Unrealmanner

more options

A few days ago firefox started closing on its own without any pop-up or anything. At first I thought my flash wasn't up to snuff but firefox said that I had the latest version. Then I checked my add-ons and noticed a weird add-on called EixxstraSavvINgs 4.2. Everytime I close and start firefox that add-on keeps coming back even if I uninstall it/remove it from the add-on tab. Same thing with chrome. Has anyone ever encountered something like this before? If so any help would be appreciated

A few days ago firefox started closing on its own without any pop-up or anything. At first I thought my flash wasn't up to snuff but firefox said that I had the latest version. Then I checked my add-ons and noticed a weird add-on called EixxstraSavvINgs 4.2. Everytime I close and start firefox that add-on keeps coming back even if I uninstall it/remove it from the add-on tab. Same thing with chrome. Has anyone ever encountered something like this before? If so any help would be appreciated

Ñemoĩporã poravopyre

Only this one: HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}

Emoñe’ẽ ko mbohavái ejeregua reheve 👍 0

Opaite Mbohovái (15)

more options

It could well be malware which is constantly re-installing the add-on. Have you checked your computer for malware using software such as Malwarebytes and/or Superantispyware (both have good free versions)? If not, I would recommend doing so.

more options

I've tried using Malwarebytes but the search said nothing was out of the ordinary. Thanks for the tip though.

more options

Try other anti-malware programs then because each one on its own is not 100%. Also use a good uninstaller like RevoUninstaller (it has a free version) to see if anything dodgy has been installed. Also use Autoruns to see if the malware is auto running any programs or services at startup.

more options

Extensions that do not have a "Remove" button are installed by other software and are not under control of the Firefox extension manager.
Such globally installed extensions are usually found via a registry scan or are installed in a location that Firefox scans for installed extensions.

Extensions installed this way need to be removed via the settings (options/preferences) of the program that has added this extension or you need to uninstall this program via "Control Panel > Programs".
In Firefox you an only disable such an extension.

more options

hydrurga I've tried what you recommended but neither really helped me pinpoint the problem. Yet again, thanks for the tip.

more options

cor-el, english isn't my native language so I'm not 100% sure of what I'm supposed to do using that tip you gave me. Sorry but would you mind giving me a step-by-step?

more options

Such extensions can be installed via the Windows registry, but only make changes there if you know what you are doing and are familiar with editing the registry as changes take effect immediately and can't be undone unless you have exported the key.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions

You can try a malware check with more malware scanning programs on the Windows computer.
Please scan with all programs because each program detects different malware.
All these programs have free versions.

Make sure that you update each program to get the latest version of their databases before doing a scan.

You can also do a check for a rootkit infection with TDSSKiller.

See also:

more options

Basically what it means is this; Start the Windows Register Editor. On my system it is called RegEdit. In the search bar, type Mozilla.

Then look around. DO NOT CHANGE ANYTHING!

This is where Firefox looks for some of the information it needs to run. On this list, look for anything odd, like for example; EixxstraSavvINgs

Just type the first few characters. If you find anything, copy the information and post it here.

DO NOT CHANGE ANYTHING!

more options

You can do a search for EixxstraSavvINgs via Ctrl+F in the registry editor to see which keys are found and post keys that are found here as Google Chrome is involved as well like you wrote.


Do a malware check with some malware scanning programs on the Windows computer.
Please scan with all programs because each program detects different malware.
All these programs have free versions.

Make sure that you update each program to get the latest version of their databases before doing a scan.

You can also do a check for a rootkit infection with TDSSKiller.

See also:

more options

Thanks for that fredmcd-hotmail. I found that EixxstrasavvINgs thing located here: C:\ProgramData\EixxstraSavvINgs. Hopefully this will end this whole thing once and for all. So for now I'll delete it all and wait to see if anything happens.

more options

Is it okey for me to delete EixxstrasavvINgs inside the registry edit? Would it affect something?

more options

Do not remove this file yourself until it is clear that you are doing something that might affect the functioning of your computer.
At least only rename the folder where it is located if it is in its own folder and otherwise just rename the file.
It is possible that other software is involved and restores this file.

Did you check the Windows Control Panel > Programs for recently installed or otherwise suspicious programs?

Did you try the malware scanners?

more options

None of the malware scanners detected anything. The Controll panel > Programs I've already done and uninstalled the programs in question, but their extensions still remain in regedit. So would it be okey to delete them now?

more options

Which keys show up when you do a search in the registry editor?

more options

Ñemoĩporã poravopyre

Only this one: HKEY_CLASSES_ROOT\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}