December 15, 2006 2:54 PM PST

Yahoo's IM update: A Trojan horse of surprises

Last modified: December 15, 2006 5:41 PM PST

update Yahoo said late Friday that it has fixed a bug in its newest version of Yahoo Messenger that changed a user's mail preferences without his or her consent.

But the company has stopped prompting customers to update the software until it can sufficiently test that the fix works, said Yahoo spokeswoman Terrell Karlsten.

"We're testing the fix until we can get it behaving the way we want it to behave," she said.

Yahoo Messenger 8.1, when it was released Friday, automatically installed a Yahoo Mail icon in a user's system tray and changed the user's default mail settings to Yahoo Mail, said Karlsten.

Yahoo had alerted 73 million users worldwide (or all those using its IM service before November 2) to download the latest software version, which includes free or low-cost PC-to-PC calls among its chat features.

The company said the update increases stability and reliability, and improves security. The previous software contains a security flaw that could cause other applications like Microsoft's IE to crash, or prompt users to be involuntarily logged out, Karlsten said. The new version, she said, fixes that issue and bundles in new features like interoperability with Windows Live Messenger.

"The reason why we do a package, bundle everything together, is so people can get the latest version with the security updates and the great new features," Karlsten said.

Click here to Play

Video: Watch this before installing Yahoo Messenger 8.1
How to update the feature while avoiding unwanted changes to your Internet browser.

By default, the software also inserts the Yahoo Toolbar into the user's Web browser and changes the user's personalized home page and search settings to Yahoo.com. In the original download alert, people could choose to customize the installation under "options" and then uncheck these default settings. What users couldn't change, however, was that the software was adding a Yahoo Mail icon to the system tray and changed their default mail settings to Yahoo Mail.

Yahoo's Karlsten had said the engineering team was not aware of the Yahoo Mail issue and was actively working on a fix. But she said that the problem affected only a subset of existing users. She added that the company realizes everyone might not want all of the features it offers and that's why users can customize their installation. "We have really made sure we've given people choice," she said.

"The basic principle is do not change users' preferences from under them, or not through deceptive dialog boxes because a lot of people click through, like 'yeah, yeah, yeah,' without reading them."
--Jacob Nielsen, user design expert

Finally, for some people running Microsoft's Internet Explorer 6.0, Yahoo's changes will crash the browser application.

Karlsen said that Messenger should be compatible with IE 7 and earlier versions, but the company is investigating.

The company also added language to its terms of service related to a new auto-updater practice. In the default setting, Yahoo will automatically download software to the client's PC whenever it has an update, and then alert the user when to install the software.

Jacob Nielsen, an expert on user design and principal of Nielsen Norman Group, said that Yahoo is not alone in its default changes, but the strategy runs contrary to what he calls software ethics.

"The basic principle is do not change users' preferences from under them, or not through deceptive dialog boxes because a lot of people click through, like 'yeah, yeah, yeah,' without reading them," said Nielsen, author of Prioritizing Web Usability."

"You don't want to make any changes unless they ask for it," he added.

Through research he's found that the average person on the Internet is clueless as to how to fix the changes that software bundles--like Yahoo's--typically make to their PC. Only people who are tech-savvy or work in the industry understand the concept of maintaining preferences that they can change, he said.

What's more problematic, he said, is that problems or collective clutter resulting from software bundles can serve to confuse the general public and cause consumers to be afraid of downloading anything.

"To the average user, they think, 'My computer used to work and now it doesn't and I don't know why.'

"All these small violations pollute the interface and degrade the ability of all the service providers to make updates, especially when they step over the line," Nielsen said.

At least one longtime user of Yahoo Messenger won't download the new version because she expects problems.

"I don't plan to download the latest YIM because the last one took over so many things without telling me beforehand that it took days to get it all untangled," said Erica Schroeder, a tech executive in the San Francisco Bay Area. "I was so mad I almost dumped the application off my system entirely. Yahoo should know better."

See more CNET content tagged:
Yahoo! Mail, Yahoo IM, Yahoo! Inc., ethics, preference

Add a Comment (Log in or register) 34 comments (Showing first 20 comments)
I updated this morning and it gave me....
by anarchyreigns December 15, 2006 4:49 PM PST
I updated from 8.0 to 8.1 this morning and I was given the option to do a custom install. The custom install gives you the ability to prevent the default installation and the associated changes it makes. So, unless Yahoo! changed the procedure from the way it was implemented this morning, this report is incorrect.

As far as I know, those changes only occur when the user chooses the default installation and that's how it's been with Yahoo! Messenger for some time now.
Reply to this comment View all 2 replies
Expect better....
by KsprayDad December 15, 2006 5:23 PM PST
You know...things like negative option billing is illegal in Ontario and so should negative option bundling.

Yahoo...if your products are good put them in as an OPTION TO INSTALL not an OPTION TO UNINSTALL. You look very unprofessional doing it this way.
Reply to this comment
I got no trojan horse
by freddyflinty December 15, 2006 9:28 PM PST
There is no virus. I got the install message today and did the upgrade. My anti virus didn't find any trojan horse. I unchecked all boxes to just get the IM like always. My email default got changed but article says they are fixing it.
Reply to this comment View all 3 replies
No way this was a "mistake"
by Marcus Westrup December 15, 2006 9:34 PM PST
The last few versions of IM have been installing more than they should. All I've ever wanted was the Messenger - nothing else. But there is no way to prevent extra crap from getting installed, and even a partial uninstall won't remove all those extras. I had to get hints from a hacker site to disable the add-push engine, and a firewall to cut down on the Phone Home nonsense.
Really, can any of this be an accident?
Reply to this comment
What should I do?
by Voltron_Fan December 16, 2006 9:46 AM PST
I downloaded the update BEFORE I knew of this. SO I'm wondering what I should do to see if anything on my laptop or my Y! mail acct have been changed/affected?
Reply to this comment
Criminal act
by n3td3v December 16, 2006 10:20 AM PST
'engineering team wasn't aware of yahoo mail issue'

who was then?

Someone put it there.

Idiots.

Are Yahoo saying 'criminal act' has been commited?

Rogue employee edits source code to change everyones e-mail to Yahoo?

lol...

Admit your failures, be brave.
Reply to this comment
GOP
by gggg sssss December 16, 2006 10:27 AM PST
First thing Monday morning - a new broup policy - no more Yahoo IM, Mail, Toolbar in my network. But Yahoo is not alone - Quicktime tries to install iTunes and take over all media, Google is not quite as bad but who needs Google desktop?
Reply to this comment View all 2 replies
A "bug", but NO
by PCCRomeo December 16, 2006 11:25 AM PST
Whatever Yahoo. A bug is unintentional, you meant for this version
to hijack a persons email client just like you have their search
engine and hompage for years. You are so out of touch with reality
it isn't even funny.
Reply to this comment
Simple Solution: Switch to Google Talk.
by anarchyreigns December 16, 2006 11:56 AM PST
<eom>
Reply to this comment View reply
Terry Smell Fails Us All
by CancerMan2 December 16, 2006 9:00 PM PST
Fat Man with fat wallet writes fat code. Fat Man cannot write a decent spam filter, resulting in Yahooers being bombarded with spam from Korea, China, Russia, and Brazil. Fat Man's HTML image blocking option no longer works. Does Fat Man even know how to use a computer?

Here Fat Man, see the garbage spam I have to put up with in one single day because you are too busy combarding Yahoo customers with ads in your Messenger and hijacking their browsers to write a decent spam filter. Know how many spam emails I get in Googlemail Fat Man? Zero! Maybe you could learn something from them.

Fat Man's Spam-O Email Filter
WhitneytoAcostamv@mailvision.net chaise
Mariano Kane Merdeia is pro cellulite kliller
Zelma Greene hi_ ospbfrngichiicmmartl
Henry T. Basil item
Jumanah Bridge Re: hauteu info
Adaline Gordon Anything else u need
Tammie Mccollum Dlon't Let your arlm loan go
Jo Erwin Ere.c.tille meds lowlest cost
Mariana Myers Low-Profile Company With High
Marian Dickey Your lApproval Code
Fannie Hines Order Shipped
under load foAll
Meaghan Rupp Re: halfpennywort
Rick Watkins Want to be a hero in a bed? 6
Barlaam Haltom Re: declinomete
Washington Sorry about last wk
Anthony Babcock Want to be a hero in a bed? 4
Denis V. Park compelling desire
Felicienne Pizarro Re: bombin info
Will this seems to be a huge resource covering lots of different areas.
AllieeSuareza@GoBigWest.com berserk
Stephan Schafer Increase your ***** Size 1
Katheryn astounding opportunity with
Lorraine Field Merdeia isl pro clellulite
Reply to this comment
still doing it.
by mattumanu December 16, 2006 9:03 PM PST
Stupid yahoo! Everyone cover your eyes, because I'm about to blow. Maybe they'll see it from wherever they are.

YAHOO! I DON'T WANT YAHOO TOOLBAR OR YAHOO SERVICES!
Reply to this comment
"Update?" Could have fooled me!
by mstrhypno December 17, 2006 6:07 AM PST
For Mac users, this was a complete non-event. We STILL have NO VOICE CHAT, which is one of the BIGGEST gripes many users have had about this system!

Yahoo has been promising it to us for YEARS and still hasn't delivered.

And, on the PC side, when I read the article, I had to laugh. What high school programming class project actully did this alleged "update" for them?

Even a Programming 101 student knows that it is basic coding to set defaults and load a program! Evidently, no one told the development team at Yahoo this when they went through their mail order programming classes.

And Yahoo development "didn't know that the product was not compatible with" Internet Explorer 6?

Who do they THINK are they kidding?

Basic product testing protocols REQUIRE that a product like this be tested on the most common browsers. And IE, last time I looked, was THE most common browser. So one would obviously check for the TWO most recent releases - 6 & 7.

But not Yahoo, evidently.

So, I have to ask, again - WHICH high school programming class gets the 'F' for THIS boondoggle?

Or, perhaps I should ask "Which MANAGER at Yahoo should get the 'F' for not REVIEWING their WORK PROPERLY?"

Because that's the real question.

This critter was let out of the stable before the vet gave it all of its shots.
Reply to this comment
Internet Explorer 7
by patleiby December 17, 2006 8:13 AM PST
D/l IE7 when first came out. Continous scrolling. Emailed Microsoft, no answer. Restored system.
D/L again past week. Scrolling still there, could not sign on to my Yahoo. Again emailed Microsoft. again no answer.
Day 2, could not even sign on to wireless connection. Restore again. I think I will go shopping for some fresh fruit.
Reply to this comment View reply
Hey...Moron! Ya you installing software!!!
by quarky42 December 17, 2006 8:55 AM PST
1. While I *do* hate how some software defaults to changing settings and doing things "automatically" for you without asking, like automatically starting with windows without asking you if it should... Yahoo IM! like *most* installers DOES have a CUSTOM INSTALL OPTION!

2. If you are installing software on your computer and you STILL haven't realized that the default / typical install isn't usually a good idea, then you are an idiot and need to wake up!!! You should ALWAYS look for a "custom install" option. Yahoo IM! is no different. It has always had a custom option that lets you turn off all their default crap like changing your home page for instance. Sure they shouldn't try to change those settings ANYWAY, but you could have been alert enough to click CUSTOM instead of just clicking NEXT.

Don't bash Yahoo! for trying to get a little bit out of giving you a free IM program. It's not like they bundle spyware like some craptastic folks do. How do you think they make money on giving away free software? Advertising! How do they do advertising?? Through their website! and through their IM!


So next time you install something.... PAY ATTENTION!!!! Look for a "Custom" option. Never accept some unknown default installation. Think about what you are doing, and think about what the software might be doing when you look at the list of options during installation. Sometimes the defaults are great. Sometimes they suck!
Reply to this comment View reply
Yahoo should be prosecuted for this one
by michaelo1966 December 17, 2006 10:31 AM PST
Yahoo crossed the line in this one. I always uncheck all the extra garbage this thing just took over, like a piece of adware, and started downloading stuff on its own. Took over homepage, added Yahoo toolbar, took over mail defaults. Yahoo is desperate after slipping behind MySpace: they haven't had a new idea in years and will do anything to retain their market share.

Yahoo was once cool but isn't anymore: they've been just rolling along on vapor. I already boycott the Yahoo "search" (read: ad) engine: will dump YIM within the next few days.
Reply to this comment View reply
For the love of god...
by SeizeCTRL December 18, 2006 5:53 AM PST
STOP THE BUNDLING!

It's annoying! If I just want Yahoo Messenger, that's all I want. If I want QuickTime, don't make me download iTunes along with it. Make it easier to get just one piece of software without having to get the entire bundled package. Offer the bundle for those who want it, but also make it available as a standalone package.
Reply to this comment View reply
Yahoo needs to worry MORE about
by btljooz December 18, 2006 12:34 PM PST
it's OWN system!

A bot infected Y!s "Answers" section last week and epitomized on Saturday (as far as I know, that's the last time I was in there).

Here's the link to a list of "Questions" discussing it:

http://answers.yahoo.com/search/search_result;_ylt=Anae8GJwXU9w5LcLVTwKdnUjzKIX?p=%22man%22-bot

I [b][u]HOPE[/u][/b] that link allows you to see the [b][u]PROOF[/u][/b] of the holes Y!s OWN servers have in them!

Yahoo! needs to look in the mirror FIRST and leave it's users' computers ALONE!!!!
Reply to this comment
The author doesn't know what a Trojan Horse is
by JoeCrow December 18, 2006 6:05 PM PST
This is *not* a trojan horse. It's merely an installer like all other installers from the big internet companies, tries to install additional components onto your computer by default. There's a pretty obvious way to prevent this from happening.

I wish CNet would report on real news and not blow these non-stories out of proportion when they're too lazy to do real journalism.
Reply to this comment
Nothing new from Yahoo
by Marv99 January 5, 2007 6:07 AM PST
Yahoo has had other applications installing it's search engine and IE bar for years. It's one of the pushiest applications company I've ever seen.

Why would this surprise anyone?

I don't often leave it on any machine I use as the search engine tends to mess up the URL and want to search for web pages that are simply down at the time. This wastes time. Sure I can change that in options but why bother for something that doesn't add function for me at any rate? BTW MSN search has the same problem. Same engine? One wonders.
Er Google rules <G>
Reply to this comment
 See all 34 Comments >>
Powered by Jive Software
advertisement

Latest tech news headlines

Resource center from News.com sponsors
Aligning CIO & CEO visions
What CIOs need to know

It's a simple truth. The closer you and your CEO see things, the greater your chance for success. Our exclusive report can help you get there—and help your business grow. To get the report, featuring the views of 765 CEOs on innovation. click here

Click Here!
What CEOs think: Innovation Insights for CIOs

Learn How CIOs can deliver strategic success for their enterprises

The New CIO: Beyond Technology

Learn how CIOs become heroes

Podcast: Chris Gorog of Napster

Learn about the impact of technology in strategy execution

The future of the Enterprise

Read more about tomorrow's organization

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

More feeds available in our RSS feed index.

advertisement

Inside CNET News

Scroll Left Scroll Right
  • News - Business Tech

    Chrome's JavaScript challenge to Silverlight

    The advent of Google's Chrome browser, software pros say, should spur a big speedup for JavaScript, which would raise its standing against Microsoft's Silverlight technology.

  • Gallery

    Photos: Top 10 reviews of the week

    Here are CNET Reviews' 10 favorite items from the past week, including the TiVo HD XL, Sony Cyber-shot DSC-H50, and the Dish Network's newest digital TV converter box.

  • News - Apple

    Apple watchers spot 'iPod Nano' pix, iTunes hints

    The rumor mill has long been predicting a longer, leaner new version of the iPod Nano, and now it's conjuring up some pictures.

  • Outside the Lines

    EIC Squared: Chrome, iPods, and a Dell-Salesforce union

    On this week's EIC Squared podcast CNET's Dan Farber and ZDNet's Larry Dignan discuss Google's latest rocket launch--the Chrome browser--as well as Apple's iPod event next week and a Dell-Salesforce.com union.

  • Video

    Katie Couric reflects on first Webcast

    The political conventions are over and so are CBS Evening News anchor Katie Couric's first series of Webcasts. CNET's Kara Tsuboi sat down with Couric on the final night of the Republican National Convention to discuss what she liked about Webcasting, some of her most memorable guests, and whether TV news will still be around by the next round of conventions.

  • News - Digital Media

    At 10 years old, whither Google?

    Daniel Sieberg of CBS News looks at how the company grew exponentially from start-up to superstar and part of our culture, but what's ahead?

  • Video

    YouTube plays party politics

    During the presidential campaigning four years ago, YouTube didn't even exist. Now it's a tool candidates must master to get their message across. CNET's Kara Tsuboi stops by the YouTube upload booths at the Democratic and Republican conventions to find out why Google's video site has such a big presence in Denver and St. Paul, Minn.

  • News - Gaming and Culture

    Are Demo and TechCrunch50 fragmenting their audiences?

    With both events scheduled to start Monday, many press, as well as venture capitalists and others are having to choose which one to attend.

  • News - Cutting Edge

    Execs predict next Google-like tech

    On eve of company's 10-year anniversary, researchers and business pundits speculate about what technologies might someday have as much impact as Google.

  • Gallery

    Images: The art of 'Spore' prototypes

    Will Wright and his Maxis team worked on dozens of prototypes to test the elements of their soon-to-be-released evolution game. Here's a sampling.

  • Webware

    How TechCrunch50 will handle its unfair advantage in heated Web 2.0 blog wars

    Inside baseball: How Webware and other blogs can compete with TechCrunch in covering the TechCrunch50 event.

  • Green Tech

    Duke Energy to invest in mini solar power plants

    Can hundreds of rooftop solar panels collectively operate like a central power plant? Duke Energy launches $100 million distributed solar program to find out.