296740 - Virus is installed without any warning when the above URL is visited

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[photos-com]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

When I type in "http://www.cracks.ss.ru" or "htp://www.cracks.ss.ru/data" I get
a virus.  I AM using Firefox, the version is: "Mozilla/5.0 (Windows; U; Windows
NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4".  I have visited other
websites this month, and have found many trojans in the Java folder.

Reproducible: Always

Steps to Reproduce:
1.  "http://www.cracks.ss.ru" (or) "http://www.cracks.ss.ru/data"
2.  Virus is auto installed after a second or two

Actual Results:  
My virus scanner found it.  Now that I have On-Access protection by Avast, Avast
warns me and allowes me to abort the connection.

Expected Results:  
Protected me from trojans/viruses, spyware, and adware.

Comment 1

[Jaime Mitchell (use [e-mail] for email)]

What version of java are you using?

Comment 2

[Pavel Cvrcek [:JasnaPaka]]

I think that there isn't Java on this page.

Avast has blocked URL
hxxp://install.xxxtoolbar.com/ist/scripts/prompt.php?event_type=onload&recurrence=always&retry=3&loadfirst=1&account_id=56715&adid=a1059804691\PxB1B10

Avast has found: JS:Istbar [Trj]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050604
Firefox/1.0+

Comment 3

[:Gavin Sharp [email: [e-mail]]]

Your antivirus program is simply seeing the code in the browser's cache, and
reacting. The code is not executable in any way, it's just there to be deleted
when you empty your cache. This is INVALID.

Comment 4

[William Bumgarner [:zsinj]]

I see this as the user has anti-spyware software installed, but wants Firefox to
come with spyware/adware protection integrated into it, Correct?

<- INVALID

Comment 5

[:Gavin Sharp [email: [e-mail]]]

*** Bug 296754 has been marked as a duplicate of this bug. ***

Comment 6

[:Gavin Sharp [email: [e-mail]]]

*** Bug 296755 has been marked as a duplicate of this bug. ***