X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

How do I remove an extension that keeps reinstalling itself?

Posted

Last week, I downloaded Mumble, a voice chat program. I was playing World of Warcraft at the time, and needed to download Mumble on the fly, so I was insufficiently careful and downloaded an extension, Websteroids, at the same time. Websteroids highlights words in text documents which, when scrolled over, lead to advertisements. The claim of the Websteroids website is that it turns a webpage into a meteoroids game.

I have repeatedly disabled and removed it from my extensions list, uninstalled and reinstalled Firefox, deleted files with the Websteroids name on it, uninstalled it and Mumble, and any other files/programs that I could find from that date.
I've run my antivirus program (AVG), spybot s&d, and lavasoft ad aware and followed the advice from their scans. Nevertheless, Websteriods keeps reinstalling itself without warning.
I have restarted Mozilla in safe mode and I've also deleted anything I could find from the publisher, Creative Island Media, LLC.
The next step that I can think of is a system restore. Before I do that, is there any other less drastic step that might work? 

Thank you

Chosen solution

Hi kg-227, unless Firefox is itself infected, uninstalling/reinstalling shouldn't make a difference.

There are cases in which third party software is dropped into the Firefox program folder and doesn't get cleaned out automatically. This is by design so you don't lose plugins, but could be exploited. To address that situation, you can rename the Firefox folder and then reinstall.

Download the installer for your preferred language from this page:

https://www.mozilla.org/en-US/firefox/all/

After exiting Firefox, rename the program folder to something like OldFox.

On 64-bit Windows, it's:

C:\Program Files (x86)\Mozilla Firefox

On 32-bit Windows, it's:

C:\Program Files\Mozilla Firefox

Then run the installer. It should find your existing personal data automatically.

Read this answer in context 1
Post a Reply

Additional System Details

Installed Plug-ins

  • Shockwave Flash 11.9 r900
  • Raidcall plugin
  • Website Logon Plugin
  • Motive Plugin for Mozilla Browsers
  • Motive Management Plug-in for Mozilla Browsers
  • Adobe Shockwave for Director Netscape plug-in, version 11.6.6.636
  • NPWLPG

Application

  • Firefox 25.0.1
  • User Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
  • Support URL: https://support.mozilla.org/1/firefox/25.0.1/WINNT/en-US/

Extensions

  • Troubleshooter 1.1a (troubleshooter@mozilla.org)

Javascript

  • incrementalGCEnabled: True

Graphics

  • adapterDescription: AMD Radeon HD 7660G
  • adapterDescription2:
  • adapterDeviceID: 0x9900
  • adapterDeviceID2:
  • adapterDrivers: aticfx64 aticfx64 aticfx64 aticfx32 aticfx32 aticfx32 atiumd64 atidxx64 atidxx64 atiumdag atidxx32 atidxx32 atiumdva atiumd6a atitmm64
  • adapterDrivers2:
  • adapterRAM: 512
  • adapterRAM2:
  • adapterVendorID: 0x1002
  • adapterVendorID2:
  • direct2DEnabled: False
  • direct2DEnabledMessage: [u'tryNewerDriver', u'!= 8.982.*.*']
  • directWriteEnabled: False
  • directWriteVersion: 6.2.9200.16581
  • driverDate: 9-18-2012
  • driverDate2:
  • driverVersion: 8.982.10.6000
  • driverVersion2:
  • info: {u'AzureCanvasBackend': u'skia', u'AzureFallbackCanvasBackend': u'cairo', u'AzureContentBackend': u'none', u'AzureSkiaAccelerated': 0}
  • isGPU2Active: False
  • numAcceleratedWindows: 0
  • numAcceleratedWindowsMessage: [u'tryNewerDriver', u'!= 8.982.*.*']
  • numTotalWindows: 1
  • webglRendererMessage: [u'tryNewerDriver', u'!= 8.982.*.*']
  • windowLayerManagerRemote: False
  • windowLayerManagerType: Basic

Modified Preferences

  • browser.cache.disk.capacity: 358400
  • browser.cache.disk.smart_size.first_run: False
  • browser.cache.disk.smart_size.use_old_max: False
  • browser.cache.disk.smart_size_cached_value: 358400
  • browser.places.smartBookmarksVersion: 4
  • browser.sessionstore.upgradeBackup.latestBuildID: 20131112160018
  • browser.startup.homepage: www.msn.com
  • browser.startup.homepage_override.buildID: 20131112160018
  • browser.startup.homepage_override.mstone: 25.0.1
  • dom.mozApps.used: True
  • extensions.lastAppVersion: 25.0.1
  • gfx.blacklist.direct2d: 3
  • network.cookie.prefsMigrated: True
  • places.database.lastMaintenance: 1385521999
  • places.history.expiration.transient_current_max_pages: 104858
  • plugin.disable_full_page_plugin_for_types: application/pdf
  • plugin.importedState: True
  • privacy.cpd.sessions: False
  • privacy.sanitize.migrateFx3Prefs: True
  • privacy.sanitize.timeSpan: 0
  • storage.vacuum.last.index: 0
  • storage.vacuum.last.places.sqlite: 1385425806

Misc

  • User JS: No
  • Accessibility: No
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

The company's website mentions uninstalling from the Control Panel or using a program in its program folder:

  • Windows Control Panel: Click Start > Control Panel > Add / Remove Programs > Websteroids

    On Windows 8, try Programs or Programs and Features > Uninstall a program
  • Windows Program Files: Click Start > Computer > C Drive > Program Files > Websteroids > Uninstall

    On 64-bit Windows, I'd also check C:\Program Files (x86)\

Does that help?

این برای شما مفید بود؟ 13
پاسخ

Question owner

Thanks for the suggestions. Unfortunately, I did both of those things.

Modified by mikewills

این برای شما مفید بود؟ 1
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

I didn't read your post very carefully, did I.

If you sort the Uninstall a Program list by install date, does anything else pop up as potentially related?

این برای شما مفید بود؟ 2
پاسخ

Question owner

Yeah, I didn't state it in my original post, but when I was uninstalling Mumble and Websteriods, I also uninstalled all programs from the same date.

این برای شما مفید بود؟ 0
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

Is the extension being dropped into a Firefox folder, either in C:\Program Files (x86)\ or your profile folder?

If you are finding the extension somewhere else, and you are familiar/comfortable with RegEdit.exe, look in these keys for anything related to Websteroids:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions
این برای شما مفید بود؟ 2
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

Two things I'd check at the Windows level:

(1) Startup programs. It sounds as though "something" remains resident. The Autoruns utility is a good tool to examine what is running at startup and disable it if it sounds suspicious.

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

(2) Scheduled Tasks. Some malware creates a scheduled task.

http://windows.microsoft.com/en-us/windows7/schedule-a-task

این برای شما مفید بود؟ 1
پاسخ

Question owner

I didn't see anything overly suspicious from the Autoruns utility, although I am not sure I understood what it was telling me well enough.

I did find something suspicious on scheduled tasks and removed that.
I also realized that I was not seeing hidden files. When I did that, there was an `updater' folder which contained updates and an uninstaller for Websteriods. I ran the uninstaller and then deleted the entire folder. 
This may have done the trick. I'll probably have to wait a few hours before I know for sure.
این برای شما مفید بود؟ 0
پاسخ
kg-227 0 solutions 5 answers

Hi, i came across this forum when trying to solve this problem myself. Websteriods icon still in system tray saying "websteriods is running", only opinion for this is to hide when when hidden, it turns up again. I've removed it from the extensions and all corresponding files deleted from C drive. however the extension still installs again. I've even tried to do a factory reset on my windows 7 but it requires a windows installation disc which i didnt receive with the pc. Dont know what else to try...

این برای شما مفید بود؟ 0
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

Hi kg-227, have you tried to identify it in the Windows Task Manager? On the processes tab, you can add columns, including a description (if available) and path on disk.

To open the Task Manager, either:

  • Ctrl+Shift+Esc
  • Ctrl+Alt+Del > Start Task Manager

On the Processes tab, you can sort by the process name. Many are gibberish, so it may help to add columns.

View > Select Columns

  • Image Path Name
  • Command Line
  • Description

You can try sorting by path or command line to scan through disk locations. Unfortunately, these fields are sometimes blank. Any luck tracking it down?

این برای شما مفید بود؟ 1
پاسخ

Question owner

Every time I now open firefox, the addon tab tells me that websteroids is disabled due it to being incompatible with the current version of firefox- removing the extension has no discernible effect. This is an improvement of course, but there still seem to be lingering effects of the program.

این برای شما مفید بود؟ 1
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

Hi mikewills, thanks for the update. Could you check the shortcut you use to start Firefox to make sure that the "target" doesn't have any added commands that might be related to this extension?

(Based on Windows 7...)

right-click the shortcut > Properties > Shortcut tab

If Firefox is pinned to the Task Bar, you may need to right-click the task bar button then right-click "Mozilla Firefox" on the lower part of the menu.

The target should be simply the following, with nothing following it, on 64-bit systems:

"C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
این برای شما مفید بود؟ 1
پاسخ
kg-227 0 solutions 5 answers

Hi, sorry no nothing un-toward in the task manager and also tried your suggestion to mikewillis.

the websteriods icon is still in system tray and keep returning in the extensions on firefox

thanks for your help

این برای شما مفید بود؟ 1
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

Hi kg-227, by any chance did you check the box at the bottom to view processes started by other users? This can double the length of the list.

Another possibility is that it's starting up as a service. I think Autoruns might list those on a separate tab, or you can use the native dialog to look for it:

Start > Run (or search box) > services.msc

این برای شما مفید بود؟ 1
پاسخ
kg-227 0 solutions 5 answers

I've checked under other users, everything still seems fine, although there is a long list from local service or network service for svchost.exe. not sure if this is at all threatening ...

My internet security found 1 threat which was SPSetupd[1].exe amongst temp internet files. tried the auto runs to no avail

i did search under 'computer' and websteroids folder under program files, a image icon and a file of it is discovered. I deleted these but already done this before and they reappear again

and icon in system tray and re-occurring add on in fire fox still persists...

thank you

این برای شما مفید بود؟ 0
پاسخ

Question owner

The target seems to be correct. Thank you.

این برای شما مفید بود؟ 0
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

I think we need a malware expert to dig into it more deeply. The more advanced tools for that are a little dangerous to use without guidance. A couple of forums are suggested at the end of this article: Troubleshoot Firefox issues caused by malware.

این برای شما مفید بود؟ 3
پاسخ
kg-227 0 solutions 5 answers

thanks for your help

im guessing that if i uninstall fire fox, this may not help with this issue?

این برای شما مفید بود؟ 0
پاسخ
wegs76 0 solutions 1 answers

hello i have the same problem with websteroids i did try everything you have suggested but it still wont go. i have windows 8 please can you help me out with this.

این برای شما مفید بود؟ 0
پاسخ
jscher2000
  • Top 10 Contributor
2344 solutions 20793 answers

Chosen Solution

Hi kg-227, unless Firefox is itself infected, uninstalling/reinstalling shouldn't make a difference.

There are cases in which third party software is dropped into the Firefox program folder and doesn't get cleaned out automatically. This is by design so you don't lose plugins, but could be exploited. To address that situation, you can rename the Firefox folder and then reinstall.

Download the installer for your preferred language from this page:

https://www.mozilla.org/en-US/firefox/all/

After exiting Firefox, rename the program folder to something like OldFox.

On 64-bit Windows, it's:

C:\Program Files (x86)\Mozilla Firefox

On 32-bit Windows, it's:

C:\Program Files\Mozilla Firefox

Then run the installer. It should find your existing personal data automatically.

این برای شما مفید بود؟ 1
پاسخ
kg-227 0 solutions 5 answers

with the help of jscher2000 suggesting " Troubleshoot Firefox issues caused by malware. " i downloaded the first malware troubleshooter, and after a 45 minute full computer scan, it detected a total of 53 items of tracking cookies, temp files and other things. the icon has disappeared and i haven't had the add on as of yet. so hopefully it stays off! anyone having this problem try installing a malware trouble shooter and see if this uninstalls any un necessary files that could be the problem!

big thanks!

این برای شما مفید بود؟ 0
پاسخ
Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.