Help ! This site infest my Firefox with a virus

[Gothica]

Hi all !brbrPlease help me. Tonight I was surfing this site and my Firefox 1.5 began to promt a window to open a file named "Ads" from"http://pagead2.googlesyndication.com]. I just cancel that and I could continue surfing this site. But when I try to open my deafult home page that is google.com, it appears the same type of window asking me if I want to download the page google.com or with what program I want to open it. If I say CANCEL, then any page appears in my firefox browser, but if I say "download", the browser then donwload the page google.com to the TEMP in Window and then the google.com opens from my hard disk. The same happen with other pages under google domain. But GMAIL still open.brbrWhat can I do ?? I don't want to search with Yahoo!! And that site open well !! I want my Google back !brbrHelp me pleasebrbrPS. Excuse my English, I don't speak English as my native languagebr

[Gothica]

If this could help more ...brbrAfter that happen .. I went to Firefox settings and erase all the cache, the history, cookies, etc. ... But this didn;t fix the problem.brbrInternet Explorer works fine, it open www.google.com without problems. I haven't open this site with Internet Explorer, just with my Firefox.brbrI read the post about the virus and the Internet Explorer. But this is in my Firefox and it is really odd !brbrHELPPPPPPbr

[mondine]

This is an odd one, all right. First, which is your default browser?brIt sounds as though Firefox has somehow just got a weird file association.brWhat happens if, whenyou are prompted for download, you select 'open with' and choose Firefox?br

[Gothica]

Originally Posted by mondine

This is an odd one, all right. First, which is your default browser?BRIt sounds as though Firefox has somehow just got a weird file association.BRWhat happens if, whenyou are prompted for download, you select 'open with' and choose Firefox?BR

Thank you for reply, I will try to explain better my case, because I really need help. I read the previous post about a virus and Internet Explorer and I didn't find a relation, as evry post said: "Firefox is unvulnerable".

And YES, my Firefox it is not my default browser, I keep Internet Explorer as my default browser but I DON'T USE IT. I just use the Firefox for surfing the web. I haven't use Internet Explorer for months. Whatever I got, it was using Firefox 1.5.

It is not normal that everytime I type in Firefox: www.google.com, it appears that window and that I cannot see the page (just a blank page).If I use the Internet Explorer I can go to www.google.comwithout problems, no window appear and the page appear without problems.

I don't know what to do.

[andrew247]

It's probably not a virus, but something to do with a settings change. Do you use a proxy by any chance in Firefox? It could be out of date and causing blank pages to appear.

[mondine]

So, you span style="font-style: italic;"are/span still getting a download prompt? Or just a blank page, and nothing else?brbrIf you can open the site in IE, it seems very unlikely that it is a virus.brThis sounds like a browser problem that you're having with Firefox.br(Check under Tools; Options; Downloads; "View and Edit Actions", and make sure there isn't a file type that shouldn't be there.)brbrAlso, please mention what browser extensions you're using, any extra toolbars, and types of firewall and antivirus.br

[Gothica]

Ok, guys ... I don't have mi laptop here right now. I will check all what you say when I get home. Thank you very much for helping me.

I hope to have good nes next time !

[Gothica]

Hello !brbrThe problem is GONE ! But I want to say some words for the future:brbr1) THANK YOU to the people who read and write for helping me, thank you also to those who only read !brbr2) The problem was not because an out of date proxy, because althought I use a proxy, I could surf using Internet Explorer.brbr3) It was not a Firefox bad configuration, because I didn't change anything. I checked span class="postbody"Tools; Options; Downloads; "View and Edit Actions", and there was any file.brbr4) What I did to solve the problem? I just made a scan with the most updated "a-squared Personal" . The program found about 7 malwares in my system. One a Trojan. The program removed them and that was all ... my Firefox behave normally and I can open google.com again from my Firefox.brbrI think it was really a virus. I still don't know which ?? and don't even know how it infest my Firefox if this browser is so protected ??!!brbrI really want to understand what happen. If someone can explain me please !brbrThese are the facts:brbra) All began when I was surfing span style="text-decoration: underline;"this/span forum with my Firefox.brb) When I tried to open google.com page with my Firefox, I couldn't. It appear a window that ask me: "open the file with" or "download to".brc) If I choose open with ..... nothing more happen ... I get a blank page.brd) If I choose download to .... the google.com page was downloaded to my TEMP file and then the Firefox browser show that direction : C:\Window/TEMP/bre) I could browse the google.com page with Internet Explorer at the same time when Firefox couldn't.brf) Only some pages have that problem ... GMAIL works fine ... but not Google Earth for example.brbrWhat is this ? A conspiration against Google.com searches ??br/span

[mondine]

Well, I'm glad things are back to normal. That's the main thing. I sure wish you could have told us whatbrthe name(s) of the malware was, though. I'd like to know what happened, as well.brIt's been a couple of days, and there haven't been any other reports of this, so I hope at least that the incident was isolated.brbrIt's not unusual for a trojan to target a specific site. But this usually happens in specific circumstances.brMost often it is in the form of a redirect. Spyware that gets installed on your system that redirects a search onto the malware sponsor's site, or to some kind of spoof page.brBut again, it is hard to understand why IE still worked, and why you were still able to access Gmail, for that matter.brIf you find out any more yourself, please let us know.brbrIn the meantime, it certainly shows that no browser is invulnerable. Whatever the source,brit seems that some kind of script was run without your knowledge.brbrFor a far greater level of security, I'd recommend the Firefox extension a href="https://addons.mozilla.org/extensions/moreinfo.php?id=722&application=firefox"NoScri pt/a.brWith this, scripts on any site are off by default, until you specify which ones, per site, that you want to allow.br

[Gothica]

Mondine, thank you for your kind reply.brbrUnfortunally, I didn't save the statistics records of "A-square". I made a mistake, sorry. I don't know the name of the viruses that I delete from my System.brbrIt was my first virus !brbrBy the way I use Window 98SE ..... odd in these days .brbr

Originally Posted by mondine

Well, I'm glad things are back to normal. That's the main thing. I sure wish you could have told us whatbrthe name(s) of the malware was, though. I'd like to know what happened, as well.brIt's been a couple of days, and there haven't been any other reports of this, so I hope at least that the incident was isolated.brbrIt's not unusual for a trojan to target a specific site. But this usually happens in specific circumstances.brMost often it is in the form of a redirect. Spyware that gets installed on your system that redirects a search onto the malware sponsor's site, or to some kind of spoof page.brBut again, it is hard to understand why IE still worked, and why you were still able to access Gmail, for that matter.brIf you find out any more yourself, please let us know.brbrIn the meantime, it certainly shows that no browser is invulnerable. Whatever the source,brit seems that some kind of script was run without your knowledge.brbrFor a far greater level of security, I'd recommend the Firefox extension a href="https://addons.mozilla.org/extensions/moreinfo.php?id=722&application=firefox"NoScri pt/a.brWith this, scripts on any site are off by default, until you specify which ones, per site, that you want to allow.br