Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
i should also point out this is also done by IST, and served up by the same ysbweb.com site.
edit - one more thing. rather sad that these "disclaimers" now have to preclude any post involving issues regarding browsers, but still - i am fully aware that xpi exploits have been around for a while, leading to a rather well known patch that Mozilla did a while back. The point of the below is to illustrate the link between the install on the lyricspy site and this crack site - and the fact that its another site using the java applet method of entry. And in this case - using an .XPI to whack IE with xxx toolbar if you agree to the .XPI, and sidefind with a "cracks" toolbar if you say no to the .XPI but yes to the applet. Thank you
you may be interested to know that a new site is performing this install - only this time, an .Xpi is seemingly responsible (rather than the Win32 Exe as was the previous case). Once again, the same "Java install" technique is used and this time, an old vulnerability is being used to install it (according to Sophos and users of the Mozillazine forum, where this was initially highlighted). At this stage, it's not clear if the .XPI in question is an updated version of Troj/Briss-B, or if it's the same old doing the same old thing.
If you're running an old version of Firefox, then agreeing to the applet will (once again) infect IE, although this time round the effect is a little more subtle than the Lyricspy website install.
From the previous testing of the Lyricspy site, it was seen that disabling XPI installs would put the page into a permanent tailspin. I was then informed by members of the Mozillazine community that if the Javascript install from the Lyricspy page was attempting to do just that, then the page would end up in an endless merry-go-round. Checking the code, it is clear that this is attempted and the page attempts to feed Firefox an XPI package first, instead of a Java based installer applet:
if (InstallTrigger.updateEnabled()) {
InstallTrigger.install({'Content Access Plugin 1.01' : ''});
} else { location.replace(''); }
http://www.vitalsecu...using-java.html
Edited by Paperghost, 21 March 2005 - 06:53 AM.
Im going to stop here, because I think you are beating a dead horse and just plain milking this issue which isn't even a big issue.
).
