835678 - Blocklist Searchqu toolbar

Status: VERIFIED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[Kris Maglione [:kmag]]

I haven't confirmed this one yet, but the add-on has ~2.7M users and is widely reported as being a drive-by install without any sort of confirmation process:

http://support.mozilla.org/en-US/questions/856190
http://www.2-viruses.com/remove-searchqu
http://www.systemlookup.com/FF_Extensions/558-SearchquToolbar.html
... more than I can list

It seems like it's been retired in favor of DataMgr and other add-ons mentioned in bug 835672, since the related installers seem to universally install those instead now.

ID: {99079a25-328f-4bd4-be04-00955acaa0a7} ~2.7M users

Comment 1

[Jorge Villalobos [:jorgev] (he/him)]

It seems to still be available here: http://searchqu.ourtoolbar.com/. Can you please look into the XPI and what the add-on does?

Comment 2

[Kris Maglione [:kmag]]

Urgh. That's not the same thing. It has a different ID, and the toolbar actually says Temporary Logo like in the screenshot. It does bypass about:newaddon and change the homepage/search settings, though (with an opt-in to restoring it on uninstall). ID: {a9bb9fa0-4122-4c75-bd9a-bc27db3f9155}

Hrm. Haven't we already talked to the Conduit people about these things? This is getting ridiculous.

Comment 3

[Kris Maglione [:kmag]]

Seems to be related to {f34c9277-6577-4dff-b2d7-7d58092f272f} (1.4M users) as well.

http://www.systemlookup.com/CLSID/76413-searchresultsDx_dll.html

Comment 4

[Kris Maglione [:kmag]]

I just came across another one of these ({377e5d4d-77e5-476a-8716-7e70a9272da0}) with 850K users. According to http://www.systemlookup.com/CLSID/77038-searchresultsDx_dll.html, it's installed from bandoo.com. However, bandoo.com installed an add-on of the same name for me, but with {dd6b651f-dfb9-4142-b0bd-09912ad22674} and <30K users.

In any case, the add-on that I wound up with did not bypass about:newaddon, but did change search and homepage settings before receiving the opt-in.

The new search engines to go search-results.com, the new homepage is searchnu.com

So, to summarize, IDs so far:

{377e5d4d-77e5-476a-8716-7e70a9272da0}
{dd6b651f-dfb9-4142-b0bd-09912ad22674}
{99079a25-328f-4bd4-be04-00955acaa0a7}
{a9bb9fa0-4122-4c75-bd9a-bc27db3f9155}

Probably others :(

Comment 5

[Jorge Villalobos [:jorgev] (he/him)]

It looks like {dd6b651f-dfb9-4142-b0bd-09912ad22674} and {a9bb9fa0-4122-4c75-bd9a-bc27db3f9155} no longer have any users. Can you confirm?

Comment 6

[Jorge Villalobos [:jorgev] (he/him)]

Quick update: Michael from Bandoo says the IDs in comment #4 are likely not theirs, and in that case they should be okay to block. He's verifying to make sure.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

Blocked:
https://addons.mozilla.org/en-US/firefox/blocked/i398
https://addons.mozilla.org/en-US/firefox/blocked/i400
https://addons.mozilla.org/en-US/firefox/blocked/i402
https://addons.mozilla.org/en-US/firefox/blocked/i404

Comment 8

[Iulian Timis]

Verified as fixed in 
https://addons.mozilla.org/en-US/firefox/blocked/i398
https://addons.mozilla.org/en-US/firefox/blocked/i400
https://addons.mozilla.org/en-US/firefox/blocked/i402
https://addons.mozilla.org/en-US/firefox/blocked/i404
Closing bug.