Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Dislike Return - Pro

CRITICAL RISKRemoved from Chrome Web Store

Dislike Return - Pro

ID: kfjacfhpkbjcfeammmpcbmmjmjmaamle

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.6

Size

0.03 MB

Rating

2.6/5

Reviews

Users

8,507

Type

Extension

Updated

May 19, 2023

Publisher Contextual Analysis

Trusted

Author: Wizz ExtensionsView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

89,310

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

A powerful tool designed to enhance your browsing experience by providing advanced features related to dislikes

Introducing "Dislike Restore PRO," a comprehensive extension that empowers users by reinstating the visibility of dislikes on a popular video platform. With this extension, you can regain control and access a wealth of valuable information. By utilizing a combination of archived like and dislike data, along with input from extension users, the extension provides the most accurate ratings for your viewing pleasure. Experience a more informed browsing experience and have a wonderful day!

User Growth

Showing data from Jan 20, 2023 to Jan 19, 2024

Versions

-28.6%(-3,407 users)

Compared to 3 months ago

4 versions released in this period

Rating Count

Total: 87 ratings

Average Rating

Current: 2.63 / 5.0+2.63

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2 Code review	5

Extension Version	Code Review Findings
1.2	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js2
manifest.json2
thanksforinstall.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Phishing	critical	thanksforinstall.html (line 1)	On install, background.js opens this page in a new tab (api.tabs.create with thanksforinstall.html). The page renders a fullscreen iframe (100% x 100%, z-index 999999, no border) loading an external bit.ly redirect (h…	1.2
2	Credential Theft	high	background.js (line 25)	Message handler attempts to obtain a Google OAuth access token via chrome.identity.getAuthToken({interactive:true}) and the user's Google profile (getProfileUserInfo), then logs both to the console. The manifest does …	1.2
3	Other	high	manifest.json (line 24)	The extension impersonates the well-known open-source 'Return YouTube Dislike' (github.com/Anarios/return-youtube-dislike) by name, icon and UI, but is published under a different ID (kfjacfhpkbjcfeammmpcbmmjmjmaamle)…	1.2
4	Phishing	high	background.js (line 80)	Service worker forces a new tab to thanksforinstall.html on first install, which in turn full-screens a bit.ly redirect (see thanksforinstall.html finding). This is the trigger that makes the redirect/phishing payload…	1.2
5	Privilege Escalation	medium	manifest.json (line 15)	externally_connectable lets any page under *.youtube.com directly invoke chrome.runtime.sendMessage into the extension's background service worker. Combined with the message router in background.js (which exposes 'get…	1.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


accounts.google.com	/ServiceLogin	https://accounts.google.com/ServiceLogin
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
returnyoutubedislikeapi.com	-	https://returnyoutubedislikeapi.com
returnyoutubedislike.com	-	https://returnyoutubedislike.com
github.com	/Anarios/return-youtube-dislike	https://github.com/Anarios/return-youtube-dislike
discord.gg	/mYnESY4Md5	https://discord.gg/mYnESY4Md5
returnyoutubedislike.com	/donate	https://returnyoutubedislike.com/donate
returnyoutubedislike.com	/faq	https://returnyoutubedislike.com/faq
returnyoutubedislike.com	/help	https://returnyoutubedislike.com/help
raw.githubusercontent.com	/Anarios/return-youtube-dislike/main/Extensions/combined/manifest-chrome.json	https://raw.githubusercontent.com/Anarios/return-youtube-dislike/main/Extensions/combined/manifest-chrome.json

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

MalwareURL Malware Seclookup Malicious y eso que es virus Puro y duro que tiene esta extension cuando te redirige a esta webs search1.me tiene 2 virus malware tengan cuidado con esta basura

hackerman543·6 Feb 2024

Please help. My YouTube page got hijacked. I think it might be this extension that is causing it, but I don't know.

Larry Smith·5 Jan 2024

ATTENTION TO ALL OF CHROME EXTENSIONS FANS: DO NOT INSTALL THIS EXTENSION! IF YOU DO, THEN YOU MIGHT GET WEB SEARCH HIJACK AND SENT TO DIFFERENT WEB SEARCH. JUST DO NOT INSTALL THIS EXTENSION!

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Dislike Return - Pro

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating