May 9, 2008 7:24 AM PDT

Firefox add-on infected with Trojan remnant

Update 4:15 p.m. May 12: The file was actually infected with a remnant part of code from the Xorer Trojan, not with the full Trojan itself, according to a follow-up Mozilla blog post. The remnant "does not infect the user's machine with the virus (and) is a remnant from a virus that most likely infected the language pack developer's machine," Mozilla said. "To minimize the potential of something similar happening in the future, Mozilla is now scanning all add-ons whenever the signatures for the antivirus software are updated."

A Vietnamese language pack infected with parts of a Trojan for the Firefox Web browser was available for download from the open-source Web browser's official add-on site for months.

Mozilla, which oversees the project, announced the problem on its security blog on Wednesday, saying people should disable the add-on pack for now.

"Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008, got an infected copy," Mozilla said. "While we cannot determine the exact number of compromised downloads, there have been 16,667 total downloads of the Vietnamese language pack since November 2007, so we anticipate the impact on users to be limited."

The author of the add-on pack, who acknowledged on Thursday that his machine had been infected, isn't suspected of any intentional harm, according to the discussion of the problem. The author offered a cleaned-up version Thursday that so far appears OK.

Mozilla scans its files for viruses, Trojans, and other problems. But the file had been uploaded nearly two months before the antivirus software could detect the Trojan in question, called Xorer.

(Via SecurityFocus.)

Stephen Shankland writes about a wide range of technology and products, but has a particular focus on browsers and digital photography. He joined CNET News in 1998 and since then also has covered Google, Yahoo, servers, supercomputing, Linux and open-source software, and science. E-mail Stephen, or follow him on Twitter at http://www.twitter.com/stshank.

Topics:: Open source

Tags:: security,; Trojan,; Mozilla,; Firefox,; download

Share:: Digg; Del.icio.us; Reddit; Facebook

About Underexposed

This blog sheds light on digital photography subjects such as cameras, photo editing, and Web sites. Shankland joined CNET News in 1998 after a five-year stint as a science writer. He's a lab rat who grew up in Los Alamos, N.M., and graduated from Harvard.

Contact Stephen at Stephen.Shankland@cnet.com

Add this feed to your online news reader

Inside CNET News

Scroll Left Scroll Right

The Space Shot
NASA spacecraft confirms water ice deposits on moon
Deliberate crash of an empty rocket stage in a permanently shadowed crater near the moon's south pole last month kicked up definitive signs of water ice, scientists say.
Gallery
Photos: Top-rated reviews of the week
Technically Incorrect
Verizon ad describes negotiations with Apple?
A print ad for the Verizon Droid uses far more personal anti-iPhone references than any of its TV spots. Is this a barely subliminal description of Verizon's negotiations with Apple?
Microsoft
Hackers bypass Windows 7 activation
Coders have found a way to disable the normal activation requirements of Microsoft's latest operating system, although Redmond says it is working to shore up its antipiracy protections.
Video
Exploratorium's shocking 40th anniversary kicks off
Digital Media
Google Books settlement sets geographic, business limits
Revised settlement allows the scanning of out-of-print works from only English-speaking countries, restricts future business for Google, and gives copyright holders more rights.
Video
A new workout for the Wii
The Social
Running a contest on Facebook? That'll cost you
The social network tightened its rules for companies running contests on its platform last week, and sources say those companies will be required to buy ad space too.
Health Tech
Cough into your cell phone, not your sleeve
Software being developed by Star Analytical Services may soon enable cell phone users to record their coughs and diagnose a cold, flu, or something else.
Gallery
Images: Getting personal with Windows 7
The Cheapskate
Killer deals on BlackBerry, Droid, and Palm Pixi
Make $100 on a BlackBerry, score a Motorola Droid for $120, or scoop up a pixie-cute Palm Pixi for 25 bucks. As always, however, plan on a two-year stint with the carrier.
Green Tech
Nissan says all-electric Leaf will compete on price
Kicking off a marketing tour for the all-electric vehicle, CEO says price will be "key to the mass market" but that it's too early to say what that price will be.

Firefox add-on infected with Trojan remnant

Open source

security,

Trojan,

Mozilla,

Firefox,

download

Report offensive content:

E-mail this comment to a friend.

Warning! You will be deleting this comment and all its replies (if applicable).

Most Popular

A CNET Conversation with Eric Schmidt

Verizon tests sending RIAA copyright notices

About Underexposed

Underexposed topics

Inside CNET News