292231 - (Kazaa-toolbar) Kazaa installs a unauthorized bar in firefox

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[Justin]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: 

Kazaa installs a unauthorized bar in Firefox...

It's mostly spyware...

Reproducible: Always

Steps to Reproduce:
1.Unistall Kazaa
2.Run a spyware scan
3.

Actual Results:  
Disasspeared

Expected Results:  
tell me if i accept to install it

Comment 1

[Daniel Veditz [:dveditz]]

Clearing confidential flag: anyone who installs Kazaa and runs Firefox will see
this so it's not exactly a secret. Opening will help prevent dupes.

I'm not sure what we can do about this. Once you let a native installer run on
your machine it can do anything it wants, including, if it wants to badly
enough, replacing Firefox itself with a copy missing any "anti-Kazaa" code we
might come up with.

On further investigation it's the "Need2Find" toolbar, a separate adware app
installed by Kazaa (and agreed to by the user--in the small print--during that
install). Uninstalling Kazaa does not get rid of it, but it registers its own
uninstaller with the windows add/remove software that does clean up.

The Toolbar consists of a globally installed chrome component (thus it doesn't
show up in the Extension Manager dialog) and a plugin.

I think we let this one go -- the user agrees to install the adware and it plays
nice to the extent that it uses a standard Mozilla install mechanism
(install-chrome.txt, used by XPInstall's DELAYED_CHROME option) and uninstalls
when the user asks it to.