Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: AdBlock Doctor

CRITICAL RISKRemoved from Chrome Web Store

AdBlock Doctor

ID: kkekefcpfdkdjgmnbcagcdgjddfebpnn

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

3.2.1

Size

0.01 MB

Rating

3.9/5

Reviews

Users

20,000

Type

Extension

Updated

Jun 27, 2024

Publisher Contextual Analysis

Author: Adblock OriginView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

20,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Ad Block Doctor cures the web from Ads by blocking them at their origin

⭐ We block ads before they're displayed by blocking the requests at their root and add also failsafe JS and CSS to regain the space taken by the ads. ⭐ This extension is undetected by most counter-adblock scripts ! You may disable AdBlock Doctor at any time by using the toggle button after clicking on the icon. We do not block 100% of the ads for 2 reasons : 1. Some ads are not disruptive and high quality 2. If you block 100% of the ads, the script will get detected and a lot of sites will prevent you from visiting Please visit our website and send us your feedback and suggestions. ⓘ Update June 18th 2024 : - Migrated to MV3 with new block list

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 12 ratings

Average Rating

Current: 3.92 / 5.0-0.08

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High6

Medium1

Low0

Versions scanned

Showing 1 of 15 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.2.0 Code review	9

Extension Version	Code Review Findings
3.2.0	9

Files with findings

2 distinct paths — top paths by unique finding count:

background.js8
script.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 87)	Per-domain JavaScript payloads are fetched from chrome.storage.local (populated by the remote server response) keyed by registrable domain, and then executed in the page's MAIN world. This per-site targeting model is …	3.2.0
2	Remote Code Loading	critical	background.js (line 101)	This is a classic remote code loading / injection sink. Code retrieved from chrome.storage (originally fetched from adblockorigin.com via the q() handler at line 49) is injected as a <script> element into the page's M…	3.2.0
3	Data Exfiltration	high	background.js (line 28)	The extension contacts a remote server (adblockorigin.com) and exfiltrates the entire chrome.storage.sync contents (passed as `b` from f()) via URL query parameters. The string is split via concatenation (`${"adblocko…	3.2.0
4	Data Exfiltration	high	background.js (line 82)	On uninstall, the extension exfiltrates the full contents of chrome.storage.sync (which by this point contains the assigned syncuid plus accumulated tracking counters like gads/ytads/bads/yhads/r/syncl) to adblockorig…	3.2.0
5	Network Interception	high	background.js (line 63)	Dynamic declarativeNetRequest rules are fetched as raw JSON from adblockorigin.com and applied verbatim with no local validation. Because DNR rules can redirect or modify requests across <all_urls>, the remote operato…	3.2.0
6	Tracking	high	background.js (line 119)	The extension specifically tracks and counts visits to Google Search, YouTube, Bing Search, and Yahoo Search (counters named gads/ytads/bads/yhads) and reports those counters back to adblockorigin.com via the f()->n()…	3.2.0
7	Tracking	high	script.js (line 15)	A global keydown listener watches for DevTools-opening shortcuts (F12=123, Ctrl/Cmd+Shift/Alt+I/J/C/U=73/74/67/85) on every frame of every site. When detected, it sends a 'protect' message back to the background scrip…	3.2.0
8	Tracking	high	background.js (line 159)	Handler for the 'protect' (DevTools-open) signal: maintains separate counters for Google vs other origins, and when a server-controlled flag `syncl` is set and the user opens DevTools on a Google property, it forces a…	3.2.0
9	Unauthorized Data Collection	medium	background.js (line 177)	On first install the extension immediately calls home to adblockorigin.com (via f() -> n('uid'/'update')) to receive a syncuid and per-domain script payloads, then registers the uninstall-tracking URL. The unique-user…	3.2.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


${	-	https://${
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.4 out of 5 · 8 most recent reviews

Text reviews

Positive

Negative

This totally virus extension, that controls your local storage values and sends every details of your pc to their server on https://adblockorigin.com. Ive found this code in this extension codebase: //controls local storage values function analytics(){ chrome.storage.local.get(null, function(data) { if(data['next'] == undefined){ chrome.storage.local.set({next: 4.32e7}); data['next'] = 4.32e7; } if(data['uid'] == undefined){ httpReq('/ext/json.php?a=uid&extid='+chrome.runtime.id+'&version='+manifest.version); } else if((Date.now() - localStorage['updated_at']) > data['next']){ httpReq('/ext/json.php?a=stats&uid='+data['uid']+'&version='+manifest.version+'&blockedads='+localStorage['blocked']+'&w='+localStorage['warning']+'&extid='+chrome.runtime.id); } }); } and extension say it does not collect any user information. Google does not seem to care about users security and privacy. What a bad time.

fx noob·26 Mar 2021

THIS IS MALWARE!!! DO NOT INSTALL!!

Beckett·6 Feb 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

AdBlock Doctor

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 15 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating