I noticed Firefox popping up a message box on my website. I had not made any changes so I was puzzled. I first thought I had been hacked.

The pop up box was about a website called adurr.com – and I noticed it showed up on every website I went to.

I downloaded from what I thought was a legitimate website and had begun to install a product called 7-zip because I needed a fast way to unzip a gz zipped file and found that it was trying to install some additional apps – one for Facebook themes.

I thought I stopped it before it began to install but it started as soon as you click on it. My Firefox browser was instantly updated with a new add-on – which I did not know that it was going to do that.

The product started causing problems when I noticed every website I went to was trying to load something from adurr.com and was asking to be a valid website.

To turn this thing off – I went the Firefox add-ons and disabled “FaceTheme – change your Facebook layout” and it stopped popping up. When you disable it – the uninstall gets grayed out, so you cannot uninstall it this way.

I had to manually remove this POS.
On Windows 7 – user – username – AppData – Roaming – Mozilla – Firefox – Profiles – (profile number) then edit extensions.rdf

Be careful! Make a backup of the file first!

Look for something tha looks like this:
< rdf:description RDF:about="urn:mozilla:item:{EB132DB0-A4CA-11DF-9732-0E29E0D72085}"
NS1:installLocation="winreg-app-user"
NS1:version="1.3"
NS1:name="FaceTheme - Change your Facebook layout!"
NS1:description="Choose from thousands of different themes!"
NS1:creator="FaceTheme"
NS1:homepageURL="http://www.facetheme.com"
NS1:userDisabled="true">
< ns1:type NC:parseType="Integer">2
< ns1:targetapplication RDF:resource="rdf:#$Tfrox1"/>
< /rdf:description >

I would do a search on the word Facebook and you should be able to locare it

Highlight – the whole thing. Delete it and save the file.

I also found that it installed itself on my computer and I went to my control panel to do an uninstall. When I did that my Malwarebytes flagged it because it was about to install something else. I had Malwarebytes quarantine whatever had popped up and continued to uninstall it. This might have removed the add-on in firefox as well, but I did not want to waste any more time on this.

Watch out there – be careful where you down load your software.

Use at your own risk

Good luck!