Closed Bug 835678 Opened 9 years ago Closed 9 years ago

Blocklist Searchqu toolbar

Categories

(Toolkit :: Blocklist Policy Requests, defect)

defect
Not set
normal

Tracking

()

VERIFIED FIXED
2013-06-27

People

(Reporter: kmag, Assigned: jorgev)

References

Details

I haven't confirmed this one yet, but the add-on has ~2.7M users and is widely reported as being a drive-by install without any sort of confirmation process:

http://support.mozilla.org/en-US/questions/856190
http://www.2-viruses.com/remove-searchqu
http://www.systemlookup.com/FF_Extensions/558-SearchquToolbar.html
... more than I can list

It seems like it's been retired in favor of DataMgr and other add-ons mentioned in bug 835672, since the related installers seem to universally install those instead now.

ID: {99079a25-328f-4bd4-be04-00955acaa0a7} ~2.7M users
OS: Linux → All
Hardware: x86_64 → All
It seems to still be available here: http://searchqu.ourtoolbar.com/. Can you please look into the XPI and what the add-on does?
Urgh. That's not the same thing. It has a different ID, and the toolbar actually says Temporary Logo like in the screenshot. It does bypass about:newaddon and change the homepage/search settings, though (with an opt-in to restoring it on uninstall). ID: {a9bb9fa0-4122-4c75-bd9a-bc27db3f9155}

Hrm. Haven't we already talked to the Conduit people about these things? This is getting ridiculous.
Blocks: Conduit
Seems to be related to {f34c9277-6577-4dff-b2d7-7d58092f272f} (1.4M users) as well.

http://www.systemlookup.com/CLSID/76413-searchresultsDx_dll.html
I just came across another one of these ({377e5d4d-77e5-476a-8716-7e70a9272da0}) with 850K users. According to http://www.systemlookup.com/CLSID/77038-searchresultsDx_dll.html, it's installed from bandoo.com. However, bandoo.com installed an add-on of the same name for me, but with {dd6b651f-dfb9-4142-b0bd-09912ad22674} and <30K users.

In any case, the add-on that I wound up with did not bypass about:newaddon, but did change search and homepage settings before receiving the opt-in.

The new search engines to go search-results.com, the new homepage is searchnu.com

So, to summarize, IDs so far:

{377e5d4d-77e5-476a-8716-7e70a9272da0}
{dd6b651f-dfb9-4142-b0bd-09912ad22674}
{99079a25-328f-4bd4-be04-00955acaa0a7}
{a9bb9fa0-4122-4c75-bd9a-bc27db3f9155}

Probably others :(
It looks like {dd6b651f-dfb9-4142-b0bd-09912ad22674} and {a9bb9fa0-4122-4c75-bd9a-bc27db3f9155} no longer have any users. Can you confirm?
Quick update: Michael from Bandoo says the IDs in comment #4 are likely not theirs, and in that case they should be okay to block. He's verifying to make sure.
Product: addons.mozilla.org → Toolkit
You need to log in before you can comment on or make changes to this bug.