Rated 1 out of 5 stars

by ChasHaka on May 14, 2017 · permalink

##Warning## this addon is pure Malware!!!

The addon is clearly Adware, but also adds (3rd party) Toolbars for browser hijacking and key logging. This is was discovered when viewing an Ebay site, where a Toolbar shows, that hijacks searches to an alternate "shopping website", and logs (keylogs) data to this website.

This repressible action is alluded to in the programs cryptic notification of:
"Suggested ads - are small tips about up-to-the-minute rebates,
shown on the top of the page for certain shops you visit."

It is surprising that this repressible action is NOT made clear in the "About this Add-on" information! (The above cryptic notification was NOT displayed, and was only found buried in the addons code.)

Also, apparently, unless you enable websites to store (malicious?) tracking data, this addon will continually display Adds, and add (advertising?) toolbars for Browser Hijacking and Key Logger. Thus the claim "Advertising is disabled by default" and "advertising displays once in a lifetime...." is completely FALSE

It is also amazing that the many reviews that warn of the Malware nature of this addon are continually removed.
NOTE: There have been MANY (now deleted) reviews of the pure malware nature of this addon!
All low star reviews for this addon get removed, so do NOT believe the (possibly) false many five star reviews!

Another post stated they looked at the code and "there's nothing suspicious".
Well a very quick look at the addon code reveals:
<script type="text/javascript" src="https://s3.amazonaws.com/js-static/13fdb1e5ae9a9b3a61.js">
This is a well known source for browser redirection, add injection, and 3rd party installs of malicious code.
See https://howtoremove.guide/remove-s3-amazonaws-virus/).

Also <script type="text/javascript" src="http://cdncash.net/addons/lnkr5.min.js">
Described as Malware, and removal instructions are http://www.sitealyzer.net/en/p/sb/remove-cdncash.com/

Also <script type="text/javascript" src="http://rules.similardeals.net/ ..
Stated as a malware virus, removal instructions at https://malwaretips.com/blogs/ads-by-similardeals-removal/

Another immediate amazing piece of code is:
AddonManager.getAddonByID('customization@adblockplus.org', function(addon)
{prefs.setBoolPref('present_CustomizationsAdblockPlus', false);
So this addon amazingly does something to (disable?) "Add Block Plus".

These malicious code segments were found with just a quick look, there is no doubt many more malicious acts buried in this addons code.


Note another poster also found the extension adds further malware script files of:
<script type="text/javascript" src="http://cdncache-a.akamaihd.net/sub/nee5452/49499_319_/l.js?pid=2448&ext=Menu Wizard extension">
<script type="text/javascript" src="http://cdncash.net/addons/lnkr5.min.js">
<script type="text/javascript" src="http://rules.similardeals.net/v1.0/whitelist/1108/49499x319x/tkani?partnerName=Menu Wizard extension&partnerLink=http%3A%2F%2Fthisadsfor.us%2Foptout%3Ft%3D319%26u%3D49499%26block%3D02d38">
<iframe style="position: absolute; top: -999px; left: -999px; visibility: hidden;" src="https://cdncache-a.akamaihd.net/store/">.