*EDIT* It's a worm NSIS Media Popups - BEWARE!

[Seiji]

Am I the only one noticing more? I know by default firefox has a pop-up blocker. I keep gettin' them. Anyone else? And if so, a possible solution?

Thanks!

*EDIT*

This thread should be read by everyone:

http://www.zeropaid.com/bbs/spyware-adware/t-nsis-media-popups-38259.html

-Seiji
_________________
http://www.myspace.com/animationjesus

[arab]

i have a plug-in called adbloc you can set it to block individual adverts on pages or whole pages.

not had to use it yet but it looks the business.
_________________
arab@johnrobertson59.wanadoo.co.uk

[true]

I use NoScript plugin for FF. No pop ups whatsover. http://www.noscript.net/whats
It stops any scripts from the current site, and external sites. You can allow a site to temporary (current session) or permanetly run their scripts and not external sites' scripts

[Seiji]

Grrr here's the problem. I installed Foxie Browser Suit with Security Firewall. The Firewall was a worm. I use to like the program a bit because it blocked ads on pages, but then they pull this *! It's a new worm and a lot of people are having trouble getting tid of it.

Do NOT install Foxie Browser Suit it's a fake program with a worm that uses the firewall.exe to download more malware. You'll continue getting NSIS pop up, and it's nasty and hard to get rid of! Spyware sweeper doesn't find the thing and Norton's found a trojan, but the pop ups remain.

Foxie's websites-getfoxie.com, spreadfoxie.com

You can read more about it here. Really annoying:

http://www.zeropaid.com/bbs/spyware-adware/t-nsis-media-popups-38259.html

NSIS malware is an unknown worm or virus, the safe mode doesn't work with it because it changes your Windows system files and can't be detected even by Hijack This.

Update: Symantec has identified part of the malware infection, It installs in your "Hard Drive\Program Files\Mozilla Firefox\chrome" the file is "NSIS.jar" (an exe in a java file). It bypasses your firewall and makes copies of itself in many different folders and enbeds itself into windows system files. Because no matter how you delete it, it will come back unless you know where all the files that are infected are located. One of the system files that is know to be infected is "svchost.exe" Microsoft Service Host Process. Once it infects this system file, it has complete access to connect to the internet and do its nasty work.

It's possible that dsncaching.net is the malware's server where it gets its nasties. Adding dsncaching.net to your host file might block part of the infection.

The overall damage is still unknown at this time, it could steal your passwords, private info and no telling what else.

A system recovery was the best option for me.

I can't believe people are allowed to get away with this stuff ...
_________________
http://www.myspace.com/animationjesus

[blknight3]

YIKES!!! Now that is some nasty stuff
_________________
For every person with a spark of genius, there are a hundred with ignition trouble.

[Blackstar]

Ouch....I'll stear clear of that like the Plague!

[Seiji]

Scary thing is ... some people don't even know how they got it. They didn't install Foxie Firewall at all. Before you know it, you have pop-ups all over the place. Some are thinking they got it through MSN messenger, etc. I think it's still so new that there aren't a lot of solutions and most spyware programs/anti-virus aren't finding it. I think most who have gotten rid of it have done it manually. I think I finally got rid of it on my own and help from other forums.
_________________
http://www.myspace.com/animationjesus