Search Helper Extension

[malliz]

Can we remind you that this was installed in IE as well? What are you going to migrate to? Apple has a nasty reputation for doing the same type of thing. Seems a better idea would be to flood Microsoft with complaints. They made the problem.

[Dowdy]

Can we remind you that this was installed in IE as well? What are you going to migrate to? Apple has a nasty reputation for doing the same type of thing.

There are other options.

[Timmeh]

All browsers can be manipulated. Dropping FF is a foolish move.

[Frank Lion]

I am NOT a developer...

Yeah, I think most people here had figured that one out.

I am a USER and I got to this thread googleing for a solution. None is offered (to avoid having FF hacked)..

How about just reading the link in my previous post, instead of doing all this USER all in caps stuff?

That stuff is even easier now than when I wrote that stuff. These days, you just put about:support in the addressbar, press Enter and click 'Open Containg Folder' and you go straight to your profile.

We are talking about migrating until this MAJOR issue is solved, as a possible solution.

Nope, you are.

[djst]

The suggested solution here is already being discussed among the Firefox developers. No idea if this can make it into the Firefox 4 roadmap, but fingers crossed.

[GTryder]

For all those concerned or complaining that this Search Helper Extension is a fault of Firefox security; such as:

FIREFOX Developers !!! This is a MAJOR Security Issue:
It doesn't matter if this Search Helper Extension is from MS or not, this is a security flaw in FF for allowing ANY one to automatically install extensions without user giving permission.
Even IF (And right now no one really knows) this is MS, if they can do this, so can hackers who can use this HOLE to install - god knows what.
[Emphasis added]

1. The first thing to consider in this "security issue" is that of "allowing of permission". While this certainly does appear, up to this point in time, to be the result of a silent/stealth install directly from a Microsoft "update" There is "tacit permission implied" when downloading from any supposedly 'trusted' source. Read any EULA.

1a. If the installation of malicious code had come from any other source, who would then the user have to blame? Nine times out of ten, likely themselves.
It occurs to me, that the introduction of malware/crapware to a system, is usually the end result of the download and installation of suspicious software, from an untrustworthy source.
Yes. There certainly could be and are exceptions.Though, "this update" was not simply a 'drive-by download'.

1b.Presently, 'any' system would be vulnerable, as such. Short of not allowing 'anything' to be installed past the basic OS, this is unlikely to change.

2. For those of the opinion that somehow Mozilla/Firefox is somehow "asleep at the wheel" with regard to security issues; begin here for some 'lite reading' on the subject.

3. With redundancy intended:

http://www.osnews.com/story/23436/Microsoft_Secretly_Installs_Firefox_Extension_Through_WU
[And linked from this story is a very thorough article in http://arstechnica.com/microsoft/news/2 ... update.ars]

See > http://www.mydigitallife.info/2008/06/05/workaround-to-manually-uninstall-remove-or-delete-firefox-addon-with-add-ons-uninstall-button-disabled/[To Remove.]

http://forums.mozillazine.org/viewtopic.php?p=4693945#p4693945[To help prevent]

For anyone who is actually concerned with doing something proactive and constructive, in this regard, a visit to the above quoted links is highly recommended.

**Concern/complaint without positive action is totally useless.**

[alexsupra]

a lot of text but i cant find really useful and important information about this new trash from well-known soft-maker...
thus there is two main qestions.

1. does anybody know mozilla firefox extension ID?
(for sharp and easy removement from %appdata%\mozilla\firefox\profiles\firefox-profile-dir\ and/or %programfiles%\firefox-program-dir\extensions\)
2. and explorer (windows explorer as shell and file manager, internet explorer as web browser) extension CLSID?
(for sharp and easy removement from system registry and/or denying from future silent installation with no invitation:))

[freddy-237502384y52]

Yeah, exactly!

Users are giving Microturd full permissions when they do MS update. It's just like someone sitting down at your machine. It is not the job of Mozilla to protect against that type of attack. In fact, I would be surprised if Mozilla stopped it. Microturd is able to do anything they want -- send out spam, format your drive, drop add-ons in the Firefoxe's add-on folder, anything they want.

[LoudNoise]

Folks, let's not get out of line here.

[Shapeshifter1]

I am NOT a developer...

Yeah, I think most people here had figured that one out.

I am a USER and I got to this thread googleing for a solution. None is offered (to avoid having FF hacked)..

How about just reading the link in my previous post, instead of doing all this USER all in caps stuff?

That stuff is even easier now than when I wrote that stuff. These days, you just put about:support in the addressbar, press Enter and click 'Open Containg Folder' and you go straight to your profile.

We are talking about migrating until this MAJOR issue is solved, as a possible solution.

Nope, you are.

It's nice that you try to provide a solution but 99.9% of users do not have enough computer skills to follow any of the steps.
A simple dialog box to notify a user about a new extension and ask for permission to activate it is what's needed.
And the uninstall button should work for all extensions, and should ask for admin/root to uninstall system-wide extensions.
This has been a problem for quite a while now, since Microsoft pulled this crap with their dotnet extension about a year ago.
And nothing has been done, instead Mozilla devs are adding useless crap and removing features instead of fixing these major security holes.

[Frank Lion]

It's nice that you try to provide a solution but 99.9% of users do not have enough computer skills to follow any of the steps.

Really? You really think that 99.9% of users are incapable of doing the following?

1. Go to profile folder, by entering about:support in the addressbar and click 'Open Containing Folder'

2. In that profile, right click (assuming Windows OS here) the extensions.rdf, select Properties and change state to 'Read Only' status. - Linux guys already know how we do this in Linux.

3. You're done.

viewtopic.php?p=4693945#p4693945

I believe that users are not as incapable as you seem to think they are. I also believe that you should be discussing this with the Microsoft people who caused this problem, instead of here.

[LoudNoise]

Don't mind me-- looks like the cirrus might be coming to this here town and thought I should be prepared.

[kygin]

You had a toolbar somewhere. According to this
http://www.osnews.com/story/23436/Micro ... Through_WU

Again, no MS related toolbar. This is a new computer (two months) and I am the only user. The only installed toolbar is Google's.

[Rocketman]

Additionally, when my computer rebooted this morning and i found MS put this malware on my system, in FireFox,
I was also greeted with IE up and running. MS opened it on boot up.

I don't use IE & haven't for more years than I can remember (Netscape, then Phoenix, Firebird, Firefox). One trick I learned long ago is to configure your firewall (this is before Windoze firewall) so IE doesn't have unfettered access to the Internet. If something is causing IE to startup, your firewall has to ask permission to let IE connect. This came about years ago when malware would use IE to phone home in the middle of the night. This configuration would stop IE & you'd see something was amiss the next time you used the computer. FWIW

[malliz]

You had a toolbar somewhere. According to this
http://www.osnews.com/story/23436/Micro ... Through_WU

Again, no MS related toolbar. This is a new computer (two months) and I am the only user. The only installed toolbar is Google's.

Have you disabled or uninstalled MSN? That is the very first thing I do after I install Windows. It is now and has always been a huge security risk. Sorry but all the reports I can find point to some sort of Toolbar or "Helper" needing to be installed to have this problem and as I said people who don't have these installed don't appear to be having the same grief.

The suggested solution here is already being discussed among the Firefox developers. No idea if this can make it into the Firefox 4 roadmap, but fingers crossed.

Gee wiz! Be better if a "solution" was going to be a bit sooner than maybe Six months away.
Perhaps getfirefox would be a better place for the golly gosh type approach djst