On a Kubuntu 16.04.3 LTS that I administrate from time to time I found the Firefox extension "FF Info Guarded 4.6.5". Firefox version is 57.0.1+build2-0ubuntu0.16.04.1

On about:support is it listed with the id "{0c4df994-4f4a-4646-ae5d-8936be8a4188}". I googled about it, but could not find anything related to it. Virustotal has 0 detections for it.

What does this extension do? Is it malware?

  • Why can’t you just remove it?
    – Ramhound
    Dec 23 '17 at 16:16
  • I can. But I want to unterstand if if provided a risk to the user and if I need to clean up or change passwords ...
    – Yeti
    Dec 23 '17 at 16:48

I inspected the code inside of the xpi file and found that

  • it prevents the user from using "about:addons" (automatically closes the tab)
  • makes request to this domains: searchingvnm.com, apiurl.org, infoguardedff.com, spidtest.org, infoguardedext.com. The whois information for this domains are all protected

Conclusion: It is at least some sort of tracking software or adware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.