 | |
| |
| 17 Dec 2009 | #1 |
| | overlay.xul is back. Quote: It's been a while. If I remember correctly, a variant of Vundo was using the "overlay.xul" mechanism to hi-jack searches in the Firefox browser almost a year ago. Now, ISC reader Tom contacted us with a mystery that took him and his colleagues several days to unravel. The symptoms: You try to search with Google/Yahoo/Ask/Bing, but NoScript (a great add-on!!) warns you that the browser is actually trying to run a JavaScript from innoshots-dot-org. Having checked all the usual culprits, and run all the Anti-Virus tools you have, you find: Nothing. And the browser still redirects. overlay.xul is a Firefox mechanism to allow applications to add elements to the browser GUI, and is used for good effect by several tools. We don't know which infection vector was used in Tom's case to deposit the malicious overlay file on the machine. overlay.xul is back Further info. - Virustotal. MD5: 5b6d74705cdc585c64e4a2861ae39c29 Script.Gord.A.1 Trojan.Script.235944 Trojan.Script.235944 Last edited by JMH; 18 Dec 2009 at 12:35 AM.. Reason: Added another link. |
My System Specs | |
| 18 Dec 2009 | #2 |
| | Interesting, and frightening! I couldn't find much detail in the article about the point of infection. Does this mean that simply performing a google search is enough to infect a machine, even with Noscript? Are the infections limited to Firefox/Chrome? Either way, the low detection rate is unacceptable for something that's been in the wild for a month! I wonder why the vendors are taking so long detecting it. |
| My System Specs |
| 18 Dec 2009 | #3 |
| | More on this: Internet Storm Center Diary 2009-12-17 |
| My System Specs |
| . |
| |
| 18 Dec 2009 | #4 |
| | I think that's the same article? It looks like exactly the same text, only with an unrelated blog entry without further details before it. It even has the same images. |
| My System Specs |
 |
overlay.xul is back. problems?
« Reviewing F-Secure Internet Security 2010.
|
Forefront Client Security, MSE, Frequent DB upgrades »
| Thread Tools | |
| Similar help and support threads for: overlay.xul is back. | ||||
| Thread | Forum | |||
| Overlay Icons on Thumbnails | Music, Pictures & Video | |||
| How do I set a different overlay icon for SymLinks? | Customization | |||
| Overlay document printing | General Discussion | |||
| Help on the icon overlay. | Customization | |||
| Overlay on desktop icons | General Discussion | |||
All times are GMT -5. The time now is 06:42 AM.
