891606 - Blocklist request: VisualBee Toolbar

Status: RESOLVED FIXED

(Toolkit :: Blocklist Policy Requests, defect)

Description

[David Weir (satdav)]

In reference to this block request

https://support.mozilla.org/en-US/questions/958744

when you google the software name its coming up in a lot of malware its and their is a lot of tips on how to remove it

Comment 1

[David Weir (satdav)]

https://www.google.co.uk/search?q=visualbee+&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-GB:official&client=firefox-a#client=firefox-a&hs=Gph&rls=org.mozilla:en-GB%3Aofficial&sclient=psy-ab&q=visualbee+for+firefox&oq=visualbee+for+firefox&gs_l=serp.3...1839.6816.0.7129.20.11.7.1.2.0.1118.3653.1j5j1j6-2j1.10.0....0...1c.1.19.psy-ab.c5pIyp-uVmI&pbx=1&bav=on.2,or.r_cp.r_qf.&bvm=bv.48705608,d.d2k&fp=fe4ad454561fe62&biw=1366&bih=638 is the google string i used

Comment 2

[Jorge Villalobos [:jorgev] (he/him)]

ID from support link: {7aeae561-714b-45f6-ace3-4a8aed6e227b}

Comment 3

[Jorge Villalobos [:jorgev] (he/him)]

I suppose this software is the culprit: http://www.visualbee.com/. Anyone wants to give it a try and see if an add-on is installed, and if there's anything wrong going on?

Comment 4

[Tyler Downer [He/Him]]

I installed visualbee and did not get an add-on or setting hijack. However, this appears to be a plugin for powerpoint, and I don't have that on any of my computers, so this may have to be tested by someone with powerpoint (it may not install the extension if it detects the computer doesn't have powerpoint).

Comment 5

[u279076]

Ioana, does anyone at Softvision have access to Powerpoint? If so, could you see if you could get a reference environment set up that reproduces any malicious behaviour with the VisualBee add-on? Thanks

Comment 6

[Ioana (away)]

We have a Win 7 x64 machine with PowerPoint and we installed VisualBee on it: it appeared in PowerPoint as a plugin, but it doesn't show up in Firefox at all.

We tried with Firefox 22.0, Firefox 23.0b6 and Firefox 25.0a1.

Comment 7

[Jorge Villalobos [:jorgev] (he/him)]

Found a copy of the add-on: http://visualbeev1.ourtoolbar.com/.

It's unrelated to the software I pointed out on comment #3. The XPI available in that URL seems to follow our policies, with opt-out settings changes and resets. It's possible that most of the reports come from some other bundling, or previous versions of the installer.

Not sure what should be done here.

Comment 8

[Tyler Downer [He/Him]]

Ok, so, lucky visit to my in-laws (who I think get all the crapware known to mankind on their computers) got me visualbee. The ID is {77f5fe49-12e3-4cf5-abb4-d993a0164d9e}, and it doesn't remove it's settings (new tab, home page, and search engine) on uninstall.

Comment 10

[Jorge Villalobos [:jorgev] (he/him)]

Blocked: https://addons.mozilla.org/en-US/firefox/blocked/i436

The fact that this Conduit add-on has 3 different IDs is very concerning, though.

Comment 11

[Iulian Timis]

Verified as fixed in https://addons.mozilla.org/en-US/firefox/blocked/i436 on FF23 (Win 7).
Closing bug.

Comment 12

[VisualBee]

Hi, appreciate if you can remove VisualBee from the blocked list. The issue raised in the form of "...it doesn't remove it's settings (new tab, home page, and search engine) on uninstall. " has been resolved. Due to configuration problems this toolbar was not configured properly. In general, we aim to be compliant with Mozilla as much as possible and in this case was not. It is fix at our end and now we are fully compliant.
Thank you very much for your attention.

Comment 13

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to VisualBee from comment #12)
> Hi, appreciate if you can remove VisualBee from the blocked list. The issue
> raised in the form of "...it doesn't remove it's settings (new tab, home
> page, and search engine) on uninstall. " has been resolved. Due to
> configuration problems this toolbar was not configured properly. In general,
> we aim to be compliant with Mozilla as much as possible and in this case was
> not. It is fix at our end and now we are fully compliant.
> Thank you very much for your attention.

Can you please point us to your installer so we can verify the fix?

Comment 14

[VisualBee]

Hi, thank you for the replay. 
You can download VisualBee installer from our website www.visualbee.com by clicking on the download button. OR you can download the file directly using the link:
www.visualbee.com/download/VisualBeeInstall.exe

Comment 15

[Kris Maglione [:kmag]]

The add-on still changes the search engine before opt-in (https://people.mozilla.com/~kmaglione/images/d3dcb0453f670a0e.png). On uninstall, it prompts users to opt into reverting their settings (https://people.mozilla.com/~kmaglione/images/375d78fe5fea4293.png). This does change the default search engine back to Google, but leaves the VisualBee one installed.

Comment 16

[David Weir (satdav)]

Visual bee should get back to this soon

Please can you respond to this bug

Comment 17

[Kris Maglione [:kmag]]

The add-on has been blocked, therefore this is fixed. Conversation about backing out the block does not change that.

Comment 18

[VisualBee]

Hi, 
Regarding the first matter, we present the user the option to install the toolbar and to change the homepage and default search settings in our installer, once the user accepts any of these offers the installer executes them per the user approval. After the installer has deployed the toolbar the user is prompted with the Mozilla message asking the user to enable the extension but this happens after the installer already installed the extension in a disabled mode and changed the settings so at this stage the installer can’t revert this change in settings which in any case was done per the user consent.
Regarding the revert settings, we set back the previous/chosen default search. We will have to consult with our provider regarding the feasibility and ramifications of totally removing the other search engine although it is not in use anymore.

Comment 19

[Jorge Villalobos [:jorgev] (he/him)]

(In reply to VisualBee from comment #18)
> Hi, 
> Regarding the first matter, we present the user the option to install the
> toolbar and to change the homepage and default search settings in our
> installer, once the user accepts any of these offers the installer executes
> them per the user approval. After the installer has deployed the toolbar the
> user is prompted with the Mozilla message asking the user to enable the
> extension but this happens after the installer already installed the
> extension in a disabled mode and changed the settings so at this stage the
> installer can’t revert this change in settings which in any case was done
> per the user consent.

We can't allow this for a couple of reasons. First, users rarely change the defaults in installer wizards or read what they say, which is why we have the extra opt-in in Firefox. If refusing the opt-in still results in settings changes, then in a very large amount of cases users will end up with changes they didn't want. If done from an add-on, it's easier to opt-in to everything, and also easier to revert everything when you don't want these changes anymore.

> Regarding the revert settings, we set back the previous/chosen default
> search. We will have to consult with our provider regarding the feasibility
> and ramifications of totally removing the other search engine although it is
> not in use anymore.

I don't think this is as important as the first point and I don't consider it a requirement to unblock the add-on.

Comment 20

[VisualBee]

Hi, 
Sorry it took we long to response. I was out.
We found a way to solve the opt-in dialog take over issue. Now only when user click Allow the takeover will occur.
Appreciate if you can do a re-check and clear the block. 
our installer is at http://www.visualbee.com/download/VisualBeeInstall.exe 
A waiting for your response.

Comment 21

[VisualBee]

Hi,
Appreciate any response to my comment above. 
A waiting for your response.