So today I had the nasty surprise of launching my browser only to be welcomed by one of those "Thank you for downloading our app" pages... for a Firefox add-on which I never installed. Checking Tools -> Add-ons... yep, it's there. A site-blocking application that mysteriously appeared there sometime between my last browsing session and now.

For the record, I'm the only person in my household using this computer, and there's only one other person who has the technical know-how needed to do this kind of thing, and until today I had no reason to believe he had any intention of doing so. (This is also the reason my computer isn't password-protected.)

Also, the add-on's blacklist is completely empty, and I seem to have full control over it anyway; it's meant for self-managing websites on which you know you waste too much time. That doesn't even offer me a clue on which websites the person who installed the add-on meant to block.

Checking browser history. No pages in there that seem to indicate anyone having downloaded this app using this browser. The latest session in Session Manager seems to look exactly how I left it. Checking Event Viewer. It has no data from the time interval starting with the end of my last known session and ending tonight. My computer hasn't been turned on in this interval.

I never heard of it before, never visited their website, never had any intention of installing an add-on like this.

I'd very much like to know how the FUCK it got there.

(It doesn't seem malicious, but I still have that ugly feeling that someone's been messing with my computer without my approval. Like someone broke into your house, didn't steal or destroy anything, just left you a gizmo you're not interested in using... but it was a break-in nonetheless.)

Can this sort of thing be installed remotely by someone else? Would it be possible for someone to have scheduled the installation for today at some point in the distant past? (I know I'm venturing into baloney territory here, this is just me racking my brains for possible ways it could have gotten here...)

 

What's the name of the addon, out of curiosity?

It's technically possible for other programs on your computer to install addons in Firefox without telling you. (Newer versions of Firefox are supposed to warn you when that happens, but I don't know how reliable that is.)

 

BlockSite from wips.com.

I don't think I have any programs installed that would do this, and in any case the installation seemed to take place while the computer was turned off (or, at most, at the beginning of this session, though I doubt it -- nothing indicated that).

 

Okay, I googled around a bit and there's a thread on the mozilla forums about BlockSite - some other people had the same thing happen today. The thread says the addon is spyware.

I'd remove it and then, just to be safe, run a virus scan / malware check on your computer in case it was silently installed by a separate, malicious program. And make sure there aren't any other addons you don't recognize - someone in the thread suggested it might piggy-back on other addons.

 

Gee. So now the mystery is solved. Thanks a lot for that link, I'll be removing it right away.

 

Make sure to look for it under programs in control panel, sometimes these spyware stuff like to install themselves on your hard drive so they can keep re installing themselves on firefox.