InformAction Forums

Tom T. wrote:And I'll bet NoScript has made a lifelong user and advocate of Montagar.

Absolutely!

Tom T. wrote:Merry Christmas to all, and to this issue, good night?

Merry Christmas to all of you!

...and thanks to all that helped in solving this matter!

[snip]and (IIRC) Monty had to allow scripts to run on Google. Because the scripts were allowed, NS would no longer offer protection... so at this point, we're looking at Google, Yahoo and Firefox getting hacked. Is that a possibility, or is that just too much hacking for someone to handle?[/snip] J...

I removed them completely from his computer, but surprisingly, the files were identical (I checked them) except for creation date and time, his were 2 days prior to mine. This leads me to believe that we "acquired" this from the same location. Unfortunately neither of us keep a browsing hi...

I have just found someone else that has the same version of this malware that I had. I helped him remove it. They said that a weird thing happened while they were browsing in FF. For no apparent reason the Add-ons window popped up as if a new add-on had been installed, but the list was empty (he doe...

computerfreaker, Tom T., and GµårÐïåñ... you have private messages.

Oh, I do need to clear something else up, I was able to determine that this code is not part of any of the add-ons that the "named" developer has on mozilla.org... it appears that someone has placed a particular developers copyright info in this .xul file to make it appear that it is his c...

D'oh, all of us. Instead of searching for "innoshot", we should have been searching for files containing the affected search engines. Google, Yahoo, Bing, Ask, AOL . :oops: Tom... that was the point of my "I feel dumb" post, I was mad at myself once I saw that the search engines...

I have decided to post just the actual script code that is contained in overlay.xul The code contains no formatting, so it's just one long string. Here is the pastebin link: http://pastebin.com/f55f211e9 I have run gooredfix to make sure that nothing remains of this malware. I have also checked for ...

Well before I post the source code there are a few things that I need to get cleared up first. I have looked at the code and done some research and it appears that this code belongs to a valid FF add-on (it's listed at addons.mozzila.org). I know for a fact that I have never installed this particula...

Okay... what method should I use to post the overlay.xul code? (Post it here using the code tags, use pastebin.com, etc)

Okay, I'll admit that I am stupid for not knowing that Windows XP will not search for content inside of a .xul file, I am sure there are plenty of other extensions that are excluded as well. If I had know that, I would have looked for a program that would search the content of ALL files. Sorry about...

And so what was it? Do you still have the items? What are the dates or the directories/files? Just thinking. It may not have even been a "Mozilla" (like FF) related application. Think, MediaCoder , which uses (used) the Mozilla (XUL, whatever you may call it) backend. Obviously \Local Set...

THAT'S IT! computerfreaker's links have pointed to a different version of the same type of rouge extension "blank" install. C:\Documents and Settings\user\Local Settings\Application Data\{393297E4-C74B-47DE-A2F4-E1E2EE8C39A8} that folder contains the following: chrome.manifest (file) insta...

Wow... my head is spinning at the moment from trying to read all the latest replies. :lol: I have completely powered down my computer many times since this issue appeared. In sorting through the latest replies, I am having trouble making sure that I am checking all of the correct folders and registr...

Here are the answers to your questions. #1. Montagar, Tom, where did you guys get your Firefox copies from? I've heard about malware sites that take full advantage of Fx's popularity to host "Firefox" - cracked, virus-laden versions of Firefox. Maybe one of you fell for that... not likely,...