McAfee spam popup extension keep reloading on its own

wawood8

I've started to get popups indicating that McAfee has expired, telling me to click to renew -- but I am not using McAfee. So, I read some threads here and have narrowed it down to an extension that is saved in ...AppData\Local\Vivaldi\User Data\Default\Storage\ext -- and yeah, that is not the normal "Extensions" directory.

So, I close Vivaldi, go into File Manager, remove that directory -- but sometime later, the spam is back -- and when I go back into the file system, that ...\Storage\ext\ folder is back and populated.

So, Vivaldi is loading it, even though it appears to be an unpacked extension and Developer Mode is NOT enabled.

If I go into Extensions, enable Developer Mode and clicl Load Unpacked -- it shows up immediately.

So, is Vivaldi searching my drive on its own, looking for extensions, and then automatically loading them? If not, then how is it getting loaded?

When I check Extensions in the settings, nothing is listed.

This only started happening yesterday, and I thought I got rid of it, but when I launched Vivaldi again today, it was back.

mib3berlin

@wawood8
Hi, did you check the installed apps in Windows, I guess McAfee install an app inject this in all browser.
Does this happen in Edge, Chrome, too?
Please check chrome://serviceworker-internals
if anything related is listed.
You can delete all service worker with the Delete all Browsing Data dialogue from the tools menu with this entries enabled.

Pathduck

@wawood8 What the name of this "extension" that's in Storage\ext ? If it's named mpognobbkildjkofajifpdfhcoklimli that's part of Vivaldi itself, and should NOT be deleted.

Sounds like a case of the common Web Notification Spam to me. Some shady site has simply tricked you into clicking "Allow" on a dialog asking to show notifications. They usually target McAfee users because they're one of the largest target demographics.

Usually this can be easily removed simply by going to the site in question and toggling Notifications off again in the Site Info permissions dialog. However it's not always so easy, as they usually send you on a redirect loop where you might end up on a totally different site in the end.

Whatever you do, don't click the notifications - you will most likely end up at a "scary" warning page and a phone number ending up in an Indian Scam center. These pages look scary to unwary users and will often trigger fullscreen when clicked, confusing users who don't even know how to get out of this state.

So here's how to fix it:

Open url chrome://settings/content/notifications and remove any sites from under "Allowed to send".
Open url chrome://serviceworker-internals and remove all registrations except the one with Scope chrome-extension://mpognobbkildjkofajifpdfhcoklimli/ (this will just come back anyway).
Lastly, to avoid being tricked in the future, go to Vivaldi's Settings > Privacy & Security > Default Permissions and set Notifications => Blocked.

It could of course be that some kind of malware has installed a "hidden" extension - I doubt it, but in that case it should show up under vivaldi://system under Extensions so check that just to be sure.

Web Notifications should be outlawed. Whoever invented these were idiots, they are so easy to abuse to trick users, and they are responsible for lots of people losing their life savings to scammers.

wichtig

This post is deleted!

mib3berlin

This post is deleted!

wichtig

This post is deleted!

Pathduck

@wichtig Please do NOT derail support topics with off-topic comments and personal opinions.
I will delete such posts, this is a warning.

mib3berlin

@wichtig
My main system is Linux but I had never any security issue since 10 years in Windows.
Don´t work as Administrator may help.
I stop now, this is really OT.

wawood8

@Pathduck said in McAfee spam popup extension keep reloading on its own:

@wawood8 What the name of this "extension" that's in Storage\ext ? If it's named mpognobbkildjkofajifpdfhcoklimli that's part of Vivaldi itself, and should NOT be deleted.

Sounds like a case of the common Web Notification Spam to me. Some shady site has simply tricked you into clicking "Allow" on a dialog asking to show notifications. They usually target McAfee users because they're one of the largest target demographics.

Usually this can be easily removed simply by going to the site in question and toggling Notifications off again in the Site Info permissions dialog. However it's not always so easy, as they usually send you on a redirect loop where you might end up on a totally different site in the end.

Whatever you do, don't click the notifications - you will most likely end up at a "scary" warning page and a phone number ending up in an Indian Scam center. These pages look scary to unwary users and will often trigger fullscreen when clicked, confusing users who don't even know how to get out of this state.

So here's how to fix it:

Open url chrome://settings/content/notifications and remove any sites from under "Allowed to send".

Open url chrome://serviceworker-internals and remove all registrations except the one with Scope chrome-extension://mpognobbkildjkofajifpdfhcoklimli/ (this will just come back anyway).

Lastly, to avoid being tricked in the future, go to Vivaldi's Settings > Privacy & Security > Default Permissions and set Notifications => Blocked.

It could of course be that some kind of malware has installed a "hidden" extension - I doubt it, but in that case it should show up under vivaldi://system under Extensions so check that just to be sure.

Web Notifications should be outlawed. Whoever invented these were idiots, they are so easy to abuse to trick users, and they are responsible for lots of people losing their life savings to scammers.

As I read this, the spam was back -- and when I checked the folder, it has the name you mentioned. So, I went into Vivaldi and did all the things you suggested. I hope this takes care of it.

Thanks very much for all the help.

Blackbird

@wawood8 If it comes back, please let us know in this thread and include the name of the non-mpognobbkildjkofajifpdfhcoklimli file that was injected into the ...AppData\Local\Vivaldi\User Data\Default\Storage\ext folder.

rltidd57

@Pathduck Looks like this fixed my issue. The notifications were so annoying! Thanks again.