1

On a Kubuntu 16.04.3 LTS that I administrate from time to time I found the Firefox extension "FF Info Guarded 4.6.5". Firefox version is 57.0.1+build2-0ubuntu0.16.04.1

On about:support is it listed with the id "{0c4df994-4f4a-4646-ae5d-8936be8a4188}". I googled about it, but could not find anything related to it. Virustotal has 0 detections for it.

What does this extension do? Is it malware?

2
  • Why can’t you just remove it?
    – Ramhound
    Commented Dec 23, 2017 at 16:16
  • I can. But I want to unterstand if if provided a risk to the user and if I need to clean up or change passwords ...
    – Yeti
    Commented Dec 23, 2017 at 16:48

1 Answer 1

0

I inspected the code inside of the xpi file and found that

  • it prevents the user from using "about:addons" (automatically closes the tab)
  • makes request to this domains: searchingvnm.com, apiurl.org, infoguardedff.com, spidtest.org, infoguardedext.com. The whois information for this domains are all protected

Conclusion: It is at least some sort of tracking software or adware.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .