InformAction Forums

Try installing the latest development build from noscript.net and see if that has the same error.

the way i could tell is it went to the noscript page after installing update, then the malware exeuted right after that Sounds like an ugly coincidence to me. (Unless some moron's trying to smear NoScript...) Try going back to the NoScript page and see if anything unusual happens. If not, the popup...

EDIT: I doubt it would have been a Fx vuln as Tom was running NS... probably a plugin vuln. Not either, for the same reason: NS will protect you from plugin vulnerabilities as long as the plugin content is not downloaded from a trusted source (or even in that case, if you've got the same configurat...

EDIT: I doubt it would have been a Fx vuln as Tom was running NS... probably a plugin vuln. Not either, for the same reason: NS will protect you from plugin vulnerabilities as long as the plugin content is not downloaded from a trusted source (or even in that case, if you've got the same configurat...

... Web browsers are capable of running JavaScript outside of the sandbox, with the privileges necessary to, for example, create or delete files. Of course, such privileges aren't meant to be granted to code from the web. [[But it happens, right? (bold and italics are mine) -- T.T.]] What about exe...

My original question about the malware remains though: can JavaScript download and install files without user interaction required? If it can, that's how the script installed itself. If it can't, we're probably looking at a Fx vuln - scary. :shock: Seems like every time you run Flash (without an LS...

I don't recall installing a plugin either... it probably came with the Java VM install. The interesting question, though, is "what would happen if someone didn't have the Java VM but visited a Java-based site?" But that wasn't my case, and "probably" wasn't Montagar's. Presumabl...

My apologies. It seems another addon was blocking parts of the page; when the second addon reloaded the page, NoScript blocked the already-blocked items. After manually loading another page, then manually going to back to the first page, the items were unblocked. I'll mark this as resolved immediate...

I'm heading to pick up 1.9.9.28 right now, hopefully that will solve a similar problem I've been having. (I'm pretty sure my other problem is related to a different addon though, so I'm not going to bother you guys with that) I'll post back after I test on a clean profile... (actually a whole clean ...

Hi! Before today, trusted pages were allowed to show all objects; however, after upgrading to 1.9.9.27, even trusted pages don't get to show their objects (applets, Flash, etc.) I have the "Apply restrictions to trusted pages" option unchecked. Is this a bug, or is this expected? Thanks! (...

wait wait wait wait wait... I just downloaded NoScript, too. It came with a total of 0 3rd-party anything... I'm guessing you got tricked by some scumbag who took advantage of NoScript's high reputation to pawn his trash apps. Where did you get this "NoScript" from? Disclaimer: I'm not aff...

Something else just occurred to me. Monty, you mentioned your friend was "browsing the web when the addons dialog popped up"; that implies he wasn't installing any 3rd-party anything. That also implies he wasn't knowingly downloading anything. I'm no JavaScript guy, but I don't think JS o...

@ MONTAGAR: Sorry for shouting, but just realized: Do you still have the malware folder that was extracted from your friend's machine? It might well be yet another variant, *especially* since it exhibited a symptom you and I didn't see. It too should be analyzed and reported -- and now, I have a go...

Wow, I wonder if they give lessons on de-obbing? :) Don't know, but it's another site worth adding to the occasional reading list, which must be into the thousands by now. :) I actually cleared out most of my occasional reading list when I rebuilt my Firefox... much nicer than having an 8-page list...

hmm... want me to drop them the link to my de-obfuscation? Thanks, but I'm sure that they de-obbed (neologism?) it just fine. E. g., he told me privately that "The first part of _cfg.js is XORed with 24 and contains the URLinnoshots-dot-org/ffeed.php". I expect that they're pretty experie...