274065 - firefox is letting www.msn.com site install spyware

Status: VERIFIED INVALID

(Firefox :: General, defect)

Description

[sg1264]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

I am currently running Pest Patrol which alerts me about any spyware that has
been installed.  When I bring up www.msn.com under IE6+ the spyware is not
installed.  If I do the same under firefox the spyware is detected by Pest
Patrol.  The spyware that I am specifically concerned about is :

IBIS Toolbar
NetworkEssentials.SCBar.

As far as I know I have disabled everything to prevent the download and
installation of these 2 things.  

Is there some setting that I can use to tell me when Firefox downloads something
that autoinstalls?

I think the product is great and have no other complaints.

Reproducible: Always
Steps to Reproduce:
1. Use Pest Patrol software to remove the spyware
2. reboot win xp pro
3. run Pest Patrol software to see if the spyware is detected and it is NOT
4. open FireFox with default page set to www.msn.com
5. immediately run Pest Patrol again and the spyware is detected again

Actual Results:  
the spyware is once again present on my machine

Expected Results:  
the software should be able to detect ALL software that is being
downloaded/installed without a specific end user message.  If this situation
happens the software should have the abitlity to prompt BEFORE this is done.

WinXP Pro SP1 with all security patches other than SP2
McAfee Profession is running
Zone Alarm Pro is running

nothing else is special about this installation.

Comment 1

[Mike Kowalski]

Pest Patrol is known for false positives. Plus, I don't know how Firefox could
get spyware without downloading a .xpi or through a security exploit. Try using
Spyware Blaster to block known spyware. It could be that Firefox is getting a
cookie or something from the site and PP is finding it as spyware. Please reopen
if you continue to see this problem using Spyware Blaster.