Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: TotalAdBlock

CRITICAL RISKRemoved from Chrome Web Store

TotalAdBlock

ID: looohgelibjoplmkhecmalapkgadkfcc

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.0.8

Size

1.22 MB

Rating

2.9/5

Reviews

Users

380,008

Type

Extension

Updated

Sep 24, 2020

Publisher Contextual Analysis

Author: https://www.totalav.comView Profile
Privacy: Privacy Policy
Country: GB
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: 16-18 Barnes Wallis Road Fareham PO15 5TT GB
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

380,008

Award-winning antivirus provider, TotalAV, proudly presents it's latest browsing privacy extension, TotalAdblock.

TotalAdblock is the one privacy tool you need to take full control of your browsing experience, benefit from a wide set of advanced tools allowing you to enjoy the internet for what it was originally intended. Key benefits include, Block Unlimited Ads & Trackers Enjoy the internet peacefully without any limits by removing unlimited unwanted ads & trackers. You also have an option for ‘Acceptable Ads’ should you wish to manage your own list of websites. Disable Annoying Notifications Instantly disable annoying browser push notifications from appearing and getting in your way with our 'Quiet Mode' feature. Eliminate Malicious Websites Stay out of harm's way by eliminating malicious & misleading phishing sites, with new definitions being reviewed & added every day you'll always stay steps ahead of cybercriminals. Trust a blocked site? Simply add to your whitelist to ignore our detection. Private Browsing Go incognito with our quick private browsing option and block third party cookies tracking you by default. Clear Browsing History You decide what's stored and deleted with the option to clear history, cookies & cache within a couple of clicks Ultra-Fast Website Loading Reduce page loading speeds by removing unwanted ads & trackers streamlining your browsing experience. Get back in the driving seat today and take full control of your browsing experience by disabling unwanted ads, intrusive trackers and annoying notifications. TotalAdblock, your Privacy is our Priority.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Item	Type	Severity	Description
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
webRequestBlocking	Permission	Critical	This permission allows the extension to intercept, modify, or block any web request in real-time before it reaches its destination. Rated Critical because it can modify sensitive data (like passwords, credit cards) before encryption, redirect traffic to malicious sites, or block security updates.
<all_urls>	Permission	Critical	This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Dangerous Permission Combination	Risk Factor	Critical	This extension can intercept, modify, and block web requests in real-time.
browsingData	Permission	High	This permission clears browsing data, history, and redis. Rated High because it can destroy evidence of malicious activity, clear security logs, and modify browser state.
contentSettings	Permission	High	This permission allows modification of website-specific content settings. Rated High because it can disable security features like JavaScript restrictions, mixed content blocking, and cookie controls for specific sites.
cookies	Permission	High	This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
webNavigation	Permission	High	This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation• 15% increase: Older manifest version lacks modern security controls• 10% increase: About:blank access enables potential sandbox escape vectors
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
unlimitedStorage	Permission	Medium	This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
About:blank Access	Risk Factor	Medium	This extension can run content scripts in about:blank pages.
Older Manifest Version	Risk Factor	Medium	This extension uses Manifest Version 2
notifications	Permission	Low	This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.

By severity

Critical1

High4

Medium3

Low2

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.7 Code review	6
2.0.6 Code review	4

Extension Version	Code Review Findings
2.0.7	6
2.0.6	4

Files with findings

5 distinct paths — top paths by unique finding count:

app/background/background.min.js4
adguard/adguard-api.js3
adguard/adguard-content.js1
adguard/filters.json1
app/shared/shared.min.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Unauthorized Data Collection	critical	app/background/background.min.js (line 1)	The WebShield background script registers a blocking webRequest listener on <all_urls> that intercepts every top-level HTTP navigation (main_frame GET requests). For each non-whitelisted URL, it makes a synchronous PO…	2.0.7
2	Code Injection	high	adguard/adguard-api.js (line 41703)	This code builds a JavaScript payload as a string and injects it into the page context by creating a `<script>` element. In the same file, the injected `scriptText` is assembled from filter rules, including support fo…	2.0.6
3	Network Interception	high	app/background/background.min.js (line 1)	The AdBlock background script overrides AdGuard's official filter download servers (filters.adtidy.org) and replaces them with the extension developer's proprietary backend at https://api.totaladblocker.com/adblock. T…	2.0.7
4	Remote Code Loading	high	adguard/adguard-api.js (line 23658)	The extension can fetch filter subscriptions from an arbitrary URL and immediately pass the downloaded rules into the filtering pipeline. Because this engine also supports script/scriptlet-based rules elsewhere in the…	2.0.6
5	Unauthorized Data Collection	high	app/shared/shared.min.js (line 1)	On initialization, the Redux store reads the user's JWT from persisted state and a device clientId from LocalStorage, then registers an onBeforeRequest interceptor that injects Authorization: Bearer {jwt} and X-Client…	2.0.7
6	Other	medium	app/background/background.min.js (line 1)	The extension hard-codes a default whitelist that permanently exempts its own domains (totaladblocker.com, totalav.com) from ad blocking, ensuring ads and trackers on the publisher's own properties are never blocked f…	2.0.7
7	Remote Code Loading	medium	adguard/filters.json (line 1048)	This built-in subscription is marked with `trustLevel: "low"` and is fetched over plain HTTP rather than HTTPS. Since filter rules are remote inputs that influence blocking and script-injection behavior, an insecure t…	2.0.6
8	Tracking	medium	app/background/background.min.js (line 1)	A background interval fires every 10 minutes (600 seconds) and calls syncUser(), which makes a GET request to https://api.totaladblocker.com/v1/user carrying the user's email, device clientId, signed auth token, platf…	2.0.7
9	Code Injection	low	adguard/adguard-content.js (line 5099)	The AdGuard content script injects itself into iframe contexts using contentWindow.eval(), executing dynamically constructed code inside each frame's JavaScript context. While this is a known technique used by ad bloc…	2.0.7
10	Tracking	low	adguard/adguard-api.js (line 23840)	This posts rule-hit statistics, browser/version data, and enabled filter identifiers back to the vendor backend. The comments say this is optional, but it is still a telemetry channel derived from browsing activity an…	2.0.6

URLs

531

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


probablyprogramming.com	/2009/03/15/the-tiniest-gif-ever	http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
www.iab.net	/videosuite/vmap	http://www.iab.net/videosuite/vmap
ubuntuforums.org	/showthread.php	https://ubuntuforums.org/showthread.php?t=1911430&p=11624471#post11624471
github.com	/kud/blank-video	https://github.com/kud/blank-video
developer.microsoft.com	/en-us/microsoft-edge/platform/issues/14495220/	https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/14495220/
developers.google.com	/analytics/devguides/collection/gajs/methods/gaJSApiDomainDirectory	https://developers.google.com/analytics/devguides/collection/gajs/methods/gaJSApiDomainDirectory#_gat.GA_Tracker_._link
github.com	/gorhill/uBlock/issues/2162	https://github.com/gorhill/uBlock/issues/2162
github.com	/AdguardTeam/Scriptlets/issues/81	https://github.com/AdguardTeam/Scriptlets/issues/81
yandex.ru	/support/metrica/objects/addfileextension.html	https://yandex.ru/support/metrica/objects/addfileextension.html
yandex.ru	/support/metrica/objects/extlink.html	https://yandex.ru/support/metrica/objects/extlink.html

Showing 1 to 10 of 540 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.


2.0.58.92	IPv4	-
2.0.3.62	IPv4	-
2.0.0.28	IPv4	-
2.0.71.59	IPv4	-
2.0.1.69	IPv4	-
2.0.71.58	IPv4	-
2.0.3.23	IPv4	-
2.0.2.91	IPv4	-
2.0.1.28	IPv4	-
2.0.0.43	IPv4	-
2.0.71.57	IPv4	-
2.0.0.65	IPv4	-
2.0.71.36	IPv4	-
1.0.5.22	IPv4	-
2.0.61.48	IPv4	-
2.0.0.4	IPv4	-
2.0.4.14	IPv4	-
2.0.0.53	IPv4	-
2.0.58.82	IPv4	-
1.0.5.50	IPv4	-
2.0.0.24	IPv4	-
2.0.0.99	IPv4	-
2.0.5.89	IPv4	-
2.0.0.81	IPv4	-
2.0.72.1	IPv4	-
2.0.2.5	IPv4	-
2.0.71.34	IPv4	-
2.0.7.32	IPv4	-
2.0.3.97	IPv4	-
2.0.11.41	IPv4	-
2.0.3.79	IPv4	-
2.0.14.37	IPv4	-
2.0.3.28	IPv4	-
2.0.3.55	IPv4	-
2.0.0.29	IPv4	-
2.0.0.25	IPv4	-
2.0.2.90	IPv4	-
2.0.0.84	IPv4	-
2.0.0.95	IPv4	-
2.0.0.26	IPv4	-
2.0.7.95	IPv4	-
2.0.2.94	IPv4	-
2.0.0.51	IPv4	-
2.0.1.0	IPv4	-
2.0.0.68	IPv4	-
1.0.17.72	IPv4	-
2.0.2.63	IPv4	-
2.0.0.33	IPv4	-
2.0.60.99	IPv4	-
1.0.2.5	IPv4	-
2.0.8.27	IPv4	-
2.0.5.67	IPv4	-
2.0.1.10	IPv4	-
2.0.67.63	IPv4	-
2.0.1.99	IPv4	-
2.0.3.38	IPv4	-
2.0.14.41	IPv4	-
2.0.18.63	IPv4	-
2.0.55.15	IPv4	-
2.0.10.89	IPv4	-
2.0.23.89	IPv4	-
2.0.39.46	IPv4	-
2.0.5.78	IPv4	-
2.1.33.99	IPv4	-
2.0.16.17	IPv4	-
2.0.28.79	IPv4	-
2.0.12.20	IPv4	-
2.0.3.90	IPv4	-
2.0.0.87	IPv4	-
2.0.6.92	IPv4	-
0.0.0.0	IPv4	-
127.0.0.1	IPv4	-
1.3.132.0	IPv4	-
1.2.3.4	IPv4	-
1.101.3.4	IPv4	-
2.3.3.3	IPv4	-
2.3.3.1	IPv4	-
1:2:3:4:5:6:7:8	IPv6	-

Showing 1 to 78 of 80 rows

Rows per page:

3.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

worked well for a little bit, then went into hard sell mode with more popups and ads than most of the places it supposedly blocking. redirects, popups, popovers, bottom of the screen taken. pretty much does every worse those annoying things ad's do to make you buy the full Version. I choose to uninstall it instead

Mark Me·30 Oct 2020

it actualy works its not fake! its hard to believe but i promise its so worth it

logan levant·30 Oct 2020

I got this app from an ad on youtube, just imagine the irony

Version	Size	Is Malicious	Findings	Permhash
2.0.7 Latest	1.22 MB	Malicious	6	9a537f307c9f3516d92d9707efa8c750a837d0675ffdffdd375cd5fc827a6a09
2.0.6	1.39 MB	Malicious	4	9a537f307c9f3516d92d9707efa8c750a837d0675ffdffdd375cd5fc827a6a09
2.0.8	1.22 MB	Malicious	—	9a537f307c9f3516d92d9707efa8c750a837d0675ffdffdd375cd5fc827a6a09

Showing 1 to 3 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

TotalAdBlock

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews