one of firefox's addon is a trojan

Viruses and worms
1

I use Firefox 3.6.2 (Turkish)

C:\Program Files\Mozilla Firefox\extensions{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content
in this folder there is “timer.xul” and it is “trojan:RS/Dursg.B”

I think that addons which name’s are “XUL CACHE” and “Firefox Security Option” is trojan.

I deleted “timer.xul” many times, I uninstalled Firefox and I reinstalled it, I deleted {9CE11043-9A15-4207-A565-0C94C42D590D} folder but “timer.xul” is alive, the problem can’t be solved…

I wrote this problem on Firefox’s Security Blog but they delete my comment >:(

how can I solve this problem? Please help me ??? ??? ???

2

You have this malware:
http://www.threatexpert.com/report.aspx?md5=c0464909947c92c07f5a91f9d675f03d
The malcode is also described here: http://vil.nai.com/vil/content/v_252981.htm
also: http://vil.nai.com/vil/content/v_252981.htm#tab5
And here: http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FDursg.C
Users should not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.
Update the av solution and perform an avast boottime scan and you can run this removal tool, download from here: http://vil.nai.com/vil/stinger/default.aspx
If you have load.exe with the following MD5 hashes on your machine you are probably infected…
0328af1c93844c5dd3c4ccc368c03719
09c8649de65c00469ec5ea7b462f2fbb
122cb985fe2e679e60336299509feee2
4507d4ff33a3e17843677f78e3a2cf2d
484c03c3293bd46a83a986b453a03012
8e1e2aaf608e383897f971f58fbee2de
92ac1c350a51974572bcc9986d55d63a
932affd3c824359e994a6b2db7033412
c613eacb31a67fec6d825318964683b4
d540b2e8a46b9a246ac950da6d3c7ac6
f1f5f146a6f06633cbdda0b1e28226e7

Problem also reported here: http://www.tech-forums.net/pc/f51/infected-antivirus-xp-2010-a-224732/
And your report is also reverberated here: http://www.sophos.com/blogs/sophoslabs/v/post/8641
If firefox security ignores this it is just putting their heads in the sand like behavior, on the other hand P2P and file-sharing is a risky business to get similar worm infections, it did not come falling from the sky so to say,

polonus

3

If you have a worm and it continues to add an malicious JavaScript file to Firefox, there’s not much Mozilla can do about it except recommend a virus scan.

Try a boot time scan with avast! Right click the scanner screen, select ‘schedule a boot time scan’ and reboot when requested. (Or open the tab at the top left of the scanner screen and select the boot time option from there.)

Try the the usual free adware/spyware scanners.

SUPERAntiSpyware Free
Malwarebytes’ Anti-Malware

Download, install and update the programs.
Always select the option to quarantine any malware found rather than delete it, then you will be able to restore files or registry entries wrongly identified as malware- a rare but not unknown event for any malware scanner.