InformAction Forums

...and whatever hijacker it seems to be running in Firefox?

At random times, my browser page goes white with a "Skip this ad" link at the top. This is site-independent, and happens even from Google or Bing homepages without doing anything.

I can see "http://Roicharger.com" in my NoScript list (bottom icon pop-up list), but clicking on it does nothing. Clicking on any other link of course blocks that link as expected.

Latest version of Firefox, clean scans with MBAM, SAS, and Spybot. I am generally well versed in dealing with bugs, but this is one of the reasons I stopped using IE and switched to Firefox, back in the good ol' days!

This bug stinks. Any help would be much appreciated!

Sounds like you may have malware on your computer. NoScript isn't designed to protect you from an infection you already have. Install and run each of these programs, one after the other.
Malwarebytes' Anti-Malware
SuperAntispyware
Spybot Search & Destroy

If these don't find it or can't clear it, post in one of these forums for specialized malware removal help:
http://www.spywarewarrior.com/index.php
http://forum.aumha.org/
http://bleepingcomputer.com/

Thanks Alan, but I mentioned this part already...

"Latest version of Firefox, clean scans with MBAM, SAS, and Spybot."

My research points to Roicharger.com which runs a script. This script hijacks the browser and posts ads fully inside Firefox, and this script also shows up in NoScript's list. Clicking on it does nothing though - I should be able to block it, but it's side-stepping NoScript currently.

This may have been malware-related originally, but all's clear on all my scanners. Ran two new ones last night as well - Roicharger.com should be blockable in NoScript. Unless someone else knows of a way to block a single site permanently?

How can I add a site to NoScript's blacklist directly?

Does the same occur in IE?

Check to see that you are not (unknowingly) using a Proxy.
Check in both IE & FF.
(Perhaps even in your router.)

Does this happen in FF -safe-mode & or with a new Profile?

Check your extensions directories.
Both in the FF install directory & in your Profile.

Verify that anything within any /extensions/ directories was installed by you & are what you want.
IOW, look to see if something rogue did not plant itself there.
Pay particular attention if you find any *.dll files there. (FF shouldn't be using dll files.)


If it is external .js, could you use something in ABE like this?
Though note that at best it would only be masking your issue.
And you would need to know the name (& expect it to be unchanging) of the .js script.

lsdragon wrote:Thanks Alan, but I mentioned this part already...
"Latest version of Firefox, clean scans with MBAM, SAS, and Spybot."

You are correct. I missed that.

This may have been malware-related originally, but all's clear on all my scanners. Ran two new ones last night as well

Apparently your scanners aren't perfect. It sounds like you're still infected. Try the suggestions a web search finds to clean up your problem.
http://www.google.com/search?q=Roicharger.com&ie=UTF-8
http://www.articlesbase.com/security-ar ... 43592.html

roicharger.com will annoy you by showing fake security warning and pop-ups

Edit: You may need to use a dedicated removal tool rather than just using your scanners.
Perhaps this post and the topic it's in will help you.
http://www.bleepingcomputer.com/forums/ ... p__2144433