- http://en.wikipedia.org/wiki/Rogue_software
“…Most of the time, they will display a message such as “WARNING! Your computer is infected with Spyware/Adware/Viruses! Buy [software name] to remove it!”, a variant of which will say “Click OK to scan your system” instead of asking the user to outright buy the software. Another variant on this method involves telling the user their “Computer/Internet Connection/OS is not optimized and to Click Here to scan now”. Usually, when the dialog box’s OK button is clicked, this will (re)direct the user to a malicious website, which will install the program. Sometimes, even clicking the upper right hand X button to close the dialog box will produce the same effect. (Pressing Alt+F4 or using Task Manager with Ctrl-Alt-Delete can circumvent that trick)…”

“Using Task Manager” for some variants is the only way to get out of this situation, by terminating the BROWSER session entirely. Any other course of action may lead to a redirect and install of the malware, since the code for the redirect is already in the browser’s cache. ‘Problem is that the user has to recognize exactly what’s happening, and invoke Task Manager to quit the browser session – if they don’t, they’re hosed. This isn’t just a Firefox problem.

.

so bye firefox i will be telling everyone i know how much you suck and care nothing about your users,,and hey i would stop myself but there’s just nothing i can do about that…………

lcoffbaby@hotmail

[Lucas]: Lori, I have two suggestions. a) there are lots of fake virus scanning sites, that claim to find viruses to trick users into downloading… a virus posing as a virus scanner. If you get “scanned” by a website, its a scam b) most people get viruses from downloading random programs off the web that are infected. In the 15+ years of using various browsers (mostly Mozilla & Firefox) I’ve never gotten a virus.

First though was to check my extensions and I noticed a Java Quick Starter which I disabled, I’ll see if that works.

Any suggestion let me know.
And by the way I have the latest Firefox update 3.0.8

So that’s my long way of saying, “yes, please give us better control of global settings.”

NoScript did protect against exploitation of this vulnerability (even though could not prevent the crash itself from happening): http://hackademix.net/2009/03/26/lock-down-firefox-for-the-weekend/

Now (since 1.9.1.5, http://noscript.net/getit#devel ), it protects also against any XSLT issue triggered by malicious sites, because it regards XSLT as active content and blocks it if comes from untrusted sources:
http://hackademix.net/2009/03/27/firefox-light-speed-update-and-noscript-xslt-protection/

Likewise when this was reported by Guido he’s had to defend it against people who think it’s a non-exploitable null deref. I have personally gotten mail from respected security researchers doubting our judgment on whether this is exploitable, and they may be right — we haven’t demonstrated that it’s exploitable. But with the complex paths available to an attacker we can’t prove that all of them result in a null being left on the stack in the right place.

Incidentally, the patch languishing in bug 460090 matched our initial fix from bug 485217, which stopped the published crashes but did not in fact fix the vulnerability if you looked a little closer. Our shipping release contains a different patch from bug 485286 which fixes the vulnerability properly, not just the PoC crash.

I hope some serious thought goes into figuring out what went wrong, as it’s certainly an embarrassing situation.

http://ick2.wordpress.com/

Installation manual for FirefoxADM:
http://homepages.ed.ac.uk/mcs/FirefoxADM/ADM_Deploy.pdf