Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: TotalAdBlock

CRITICAL RISKRemoved from Chrome Web Store

TotalAdBlock

ID: looohgelibjoplmkhecmalapkgadkfcc

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.0.6

Size

1.22 MB

Rating

2.9/5

Reviews

Users

380,008

Type

Extension

Updated

Sep 24, 2020

Publisher Contextual Analysis

Author: https://www.totalav.comView Profile
Privacy: Privacy Policy
Country: GB
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: 16-18 Barnes Wallis Road Fareham PO15 5TT GB
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

380,008

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Award-winning antivirus provider, TotalAV, proudly presents it's latest browsing privacy extension, TotalAdblock.

TotalAdblock is the one privacy tool you need to take full control of your browsing experience, benefit from a wide set of advanced tools allowing you to enjoy the internet for what it was originally intended. Key benefits include, Block Unlimited Ads & Trackers Enjoy the internet peacefully without any limits by removing unlimited unwanted ads & trackers. You also have an option for ‘Acceptable Ads’ should you wish to manage your own list of websites. Disable Annoying Notifications Instantly disable annoying browser push notifications from appearing and getting in your way with our 'Quiet Mode' feature. Eliminate Malicious Websites Stay out of harm's way by eliminating malicious & misleading phishing sites, with new definitions being reviewed & added every day you'll always stay steps ahead of cybercriminals. Trust a blocked site? Simply add to your whitelist to ignore our detection. Private Browsing Go incognito with our quick private browsing option and block third party cookies tracking you by default. Clear Browsing History You decide what's stored and deleted with the option to clear history, cookies & cache within a couple of clicks Ultra-Fast Website Loading Reduce page loading speeds by removing unwanted ads & trackers streamlining your browsing experience. Get back in the driving seat today and take full control of your browsing experience by disabling unwanted ads, intrusive trackers and annoying notifications. TotalAdblock, your Privacy is our Priority.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High4

Medium3

Low2

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.7 Code review	6
2.0.6 Code review	4

Extension Version	Code Review Findings
2.0.7	6
2.0.6	4

Files with findings

5 distinct paths — top paths by unique finding count:

app/background/background.min.js4
adguard/adguard-api.js3
adguard/adguard-content.js1
adguard/filters.json1
app/shared/shared.min.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Unauthorized Data Collection	critical	app/background/background.min.js (line 1)	The WebShield background script registers a blocking webRequest listener on <all_urls> that intercepts every top-level HTTP navigation (main_frame GET requests). For each non-whitelisted URL, it makes a synchronous PO…	2.0.7
2	Code Injection	high	adguard/adguard-api.js (line 41703)	This code builds a JavaScript payload as a string and injects it into the page context by creating a `<script>` element. In the same file, the injected `scriptText` is assembled from filter rules, including support fo…	2.0.6
3	Network Interception	high	app/background/background.min.js (line 1)	The AdBlock background script overrides AdGuard's official filter download servers (filters.adtidy.org) and replaces them with the extension developer's proprietary backend at https://api.totaladblocker.com/adblock. T…	2.0.7
4	Remote Code Loading	high	adguard/adguard-api.js (line 23658)	The extension can fetch filter subscriptions from an arbitrary URL and immediately pass the downloaded rules into the filtering pipeline. Because this engine also supports script/scriptlet-based rules elsewhere in the…	2.0.6
5	Unauthorized Data Collection	high	app/shared/shared.min.js (line 1)	On initialization, the Redux store reads the user's JWT from persisted state and a device clientId from LocalStorage, then registers an onBeforeRequest interceptor that injects Authorization: Bearer {jwt} and X-Client…	2.0.7
6	Other	medium	app/background/background.min.js (line 1)	The extension hard-codes a default whitelist that permanently exempts its own domains (totaladblocker.com, totalav.com) from ad blocking, ensuring ads and trackers on the publisher's own properties are never blocked f…	2.0.7
7	Remote Code Loading	medium	adguard/filters.json (line 1048)	This built-in subscription is marked with `trustLevel: "low"` and is fetched over plain HTTP rather than HTTPS. Since filter rules are remote inputs that influence blocking and script-injection behavior, an insecure t…	2.0.6
8	Tracking	medium	app/background/background.min.js (line 1)	A background interval fires every 10 minutes (600 seconds) and calls syncUser(), which makes a GET request to https://api.totaladblocker.com/v1/user carrying the user's email, device clientId, signed auth token, platf…	2.0.7
9	Code Injection	low	adguard/adguard-content.js (line 5099)	The AdGuard content script injects itself into iframe contexts using contentWindow.eval(), executing dynamically constructed code inside each frame's JavaScript context. While this is a known technique used by ad bloc…	2.0.7
10	Tracking	low	adguard/adguard-api.js (line 23840)	This posts rule-hit statistics, browser/version data, and enabled filter identifiers back to the vendor backend. The comments say this is optional, but it is still a telemetry channel derived from browsing activity an…	2.0.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

539

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


probablyprogramming.com	/2009/03/15/the-tiniest-gif-ever	http://probablyprogramming.com/2009/03/15/the-tiniest-gif-ever
www.iab.net	/videosuite/vmap	http://www.iab.net/videosuite/vmap
ubuntuforums.org	/showthread.php	https://ubuntuforums.org/showthread.php?t=1911430&p=11624471#post11624471
github.com	/kud/blank-video	https://github.com/kud/blank-video
developer.microsoft.com	/en-us/microsoft-edge/platform/issues/14495220/	https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/14495220/
developers.google.com	/analytics/devguides/collection/gajs/methods/gaJSApiDomainDirectory	https://developers.google.com/analytics/devguides/collection/gajs/methods/gaJSApiDomainDirectory#_gat.GA_Tracker_._link
github.com	/gorhill/uBlock/issues/2162	https://github.com/gorhill/uBlock/issues/2162
github.com	/AdguardTeam/Scriptlets/issues/81	https://github.com/AdguardTeam/Scriptlets/issues/81
yandex.ru	/support/metrica/objects/addfileextension.html	https://yandex.ru/support/metrica/objects/addfileextension.html
yandex.ru	/support/metrica/objects/extlink.html	https://yandex.ru/support/metrica/objects/extlink.html

Showing 1 to 10 of 540 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.0.58.92	IPv4	-
2.0.3.62	IPv4	-
2.0.0.28	IPv4	-
2.0.71.59	IPv4	-
2.0.1.69	IPv4	-
2.0.71.58	IPv4	-
2.0.3.23	IPv4	-
2.0.2.91	IPv4	-
2.0.1.28	IPv4	-
2.0.0.43	IPv4	-
2.0.71.57	IPv4	-
2.0.0.65	IPv4	-
2.0.71.36	IPv4	-
1.0.5.22	IPv4	-
2.0.61.48	IPv4	-
2.0.0.4	IPv4	-
2.0.4.14	IPv4	-
2.0.0.53	IPv4	-
2.0.58.82	IPv4	-
1.0.5.50	IPv4	-
2.0.0.24	IPv4	-
2.0.0.99	IPv4	-
2.0.5.89	IPv4	-
2.0.0.81	IPv4	-
2.0.72.1	IPv4	-
2.0.2.5	IPv4	-
2.0.71.34	IPv4	-
2.0.7.32	IPv4	-
2.0.3.97	IPv4	-
2.0.11.41	IPv4	-
2.0.3.79	IPv4	-
2.0.14.37	IPv4	-
2.0.3.28	IPv4	-
2.0.3.55	IPv4	-
2.0.0.29	IPv4	-
2.0.0.25	IPv4	-
2.0.2.90	IPv4	-
2.0.0.84	IPv4	-
2.0.0.95	IPv4	-
2.0.0.26	IPv4	-
2.0.7.95	IPv4	-
2.0.2.94	IPv4	-
2.0.0.51	IPv4	-
2.0.1.0	IPv4	-
2.0.0.68	IPv4	-
1.0.17.72	IPv4	-
2.0.2.63	IPv4	-
2.0.0.33	IPv4	-
2.0.60.99	IPv4	-
1.0.2.5	IPv4	-
2.0.8.27	IPv4	-
2.0.5.67	IPv4	-
2.0.1.10	IPv4	-
2.0.67.63	IPv4	-
2.0.1.99	IPv4	-
2.0.3.38	IPv4	-
2.0.14.41	IPv4	-
2.0.18.63	IPv4	-
2.0.55.15	IPv4	-
2.0.10.89	IPv4	-
2.0.23.89	IPv4	-
2.0.39.46	IPv4	-
2.0.5.78	IPv4	-
2.1.33.99	IPv4	-
2.0.16.17	IPv4	-
2.0.28.79	IPv4	-
2.0.12.20	IPv4	-
2.0.3.90	IPv4	-
2.0.0.87	IPv4	-
2.0.6.92	IPv4	-
0.0.0.0	IPv4	-
127.0.0.1	IPv4	-
1.3.132.0	IPv4	-
1.2.3.4	IPv4	-
1.101.3.4	IPv4	-
2.3.3.3	IPv4	-
2.3.3.1	IPv4	-
1:2:3:4:5:6:7:8	IPv6	-

Showing 1 to 78 of 80 rows

Rows per page:

3.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

worked well for a little bit, then went into hard sell mode with more popups and ads than most of the places it supposedly blocking. redirects, popups, popovers, bottom of the screen taken. pretty much does every worse those annoying things ad's do to make you buy the full Version. I choose to uninstall it instead

Mark Me·30 Oct 2020

it actualy works its not fake! its hard to believe but i promise its so worth it

logan levant·30 Oct 2020

I got this app from an ad on youtube, just imagine the irony

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

TotalAdBlock

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews