Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: overlay.xul is back.

17 Dec 2009   #1

Win 7 Ultimate 64-bit. SP1.
overlay.xul is back.

It's been a while. If I remember correctly, a variant of Vundo was using the "overlay.xul" mechanism to hi-jack searches in the Firefox browser almost a year ago. Now, ISC reader Tom contacted us with a mystery that took him and his colleagues several days to unravel. The symptoms: You try to search with Google/Yahoo/Ask/Bing, but NoScript (a great add-on!!) warns you that the browser is actually trying to run a JavaScript from innoshots-dot-org. Having checked all the usual culprits, and run all the Anti-Virus tools you have, you find: Nothing. And the browser still redirects.
overlay.xul is a Firefox mechanism to allow applications to add elements to the browser GUI, and is used for good effect by several tools. We don't know which infection vector was used in Tom's case to deposit the malicious overlay file on the machine.
Source -
overlay.xul is back

Further info. -
Virustotal. MD5: 5b6d74705cdc585c64e4a2861ae39c29 Script.Gord.A.1 Trojan.Script.235944 Trojan.Script.235944

My System SpecsSystem Spec

18 Dec 2009   #2

Windows 7 RTM

Interesting, and frightening! I couldn't find much detail in the article about the point of infection. Does this mean that simply performing a google search is enough to infect a machine, even with Noscript? Are the infections limited to Firefox/Chrome?

Either way, the low detection rate is unacceptable for something that's been in the wild for a month! I wonder why the vendors are taking so long detecting it.
My System SpecsSystem Spec
18 Dec 2009   #3
Microsoft MVP

Windows 7 Ultimate 32bit SP1

My System SpecsSystem Spec

18 Dec 2009   #4

Windows 7 RTM

I think that's the same article? It looks like exactly the same text, only with an unrelated blog entry without further details before it. It even has the same images.
My System SpecsSystem Spec

 overlay.xul is back.

Thread Tools

Similar help and support threads
Thread Forum
Overlay Icons on Thumbnails
Hi guys, Not sure how long this has been happening but I noticed an occasional issue. Basically I have loads of videos on my laptop (mainly MP4) and WMP is the default player. When I browse the folders they all display a nice thumbnail with a little WMP icon overlay in the bottom right corner...
Music, Pictures & Video
How do I set a different overlay icon for SymLinks?
Hi. :picnic: First, I have read this: so you don't have to tell me to go there :p and Brink (the author) kindly advised me to post in this section. :) Second, I already have the basic concept of SymLinks in...
D3D9 Overlay: Not Supported
Hy! I have recently noticed that my DxDiag TXT says 'D3D9 Overlay: Not Supported'. Why is this happening? I reinstalled DirectX 9.0c and DirectX End-User Runtime, but the problem isn't solved. I think this shouldn't be like this... My full DxDiag TXT.
Graphic Cards
Help on the icon overlay.
hey guys. It's already a a month of having these overlay icons on every shortcut that I put on my desktop. :( This happened when I used the theme manager of alienware for vista. I tried to uninstall that theme manager but every time I put a shortcut on my destop there's this DVD thing on the top of...
Padlock Overlay? It means something!
Granted Raymond's blog is not really a source of information rather then entertainment...but he just recent posted about the new overlay icons in Windows 7. And in particular note, since everyone is trying to get ride of it...the padlock. The Old New Thing : What are those little overlay icons:...
Chillout Room
Overlay on desktop icons
Overlay on icons Why has my icons on the desktop acquired an overlay and how to get rid of it.
General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 18:25.

Twitter Facebook Google+

Windows 7 Forums

Seven Forums Android App Seven Forums IOS App