Beware - Firewall shuts down!

after clicking a Google link for a .info site

[nancyb]

In the last couple weeks I've been receiving increasing numbers of G alerts for my domain for spammy sites linking to me. They are all .info's that start with 4 numerals for the subdomain then some rubbish numerals and letters for the domain.

Decided to check one out this evening and looked in G's index for the site. Looked ok, so I clicked the link. BAM! ZA's true vector shut down while the page continued to load. I was using Firefox with the NoScript extension set to block all.

Been searching around the net for info but haven't found anything so far. Has this happened to anyone else? Think I need to be worried?

[mcavic]

I haven't quite seen that. But a while back I visited an NSFW site, which I had been to before with no problems. It tried to hit me with a couple of buffer overflows, and it launched Windows Picture Viewer. I did a System Restore just to be safe.

[jdMorgan]

Never mind. You posted the info I was going to ask about.

[added] I'm sure the folks at ZA would like to know about sites that run exploits that can disable the firewall without JS or ActiveX. Might also be a hole in Firefox, since the obvious vectors don't seem to be available in your case. Unless Noscript has a bug or you've got a Firefox ActiveX extension installed, there should be no way in. [/added]

Jim

[nancyb]

The site has now been removed from G's index. I posted on the ZA forum and a helpful guru checked the page out and found no problems other than very messy code. He also ran HijackThis after he loaded the page and it found nothing.

Posting to ZA tech support proved less helpful. After three tries to get an answer from them as to why ZA shut down, I gave up. Instead of answering why ZA shut down, the tech kept insisting that I could load the page if I just turned various privacy settings off Aaaaargh :(