Hi malware fighters,
Why it is important to have NoScript extension active in the case of visiting a page that has Trojan-Spy.HTML.Fraud.gen / Exploit:HTML/IframeRef.gen
http://www.securelist.com/en/descriptions/old66363
This means that this is a generic signature for IFrames whose src attribute matches a blacklist of known malicious web sites serving payloads which exploit browser or plugin vulnerabilities.
Since exploitation in 99.9% of the cases involves running JavaScript or active plugin content, NoScript will block this class of attacks even if the antivirus fails at blocking it at the proxy level because the serving site is too “new” to be listed in the blacklist, JavaScript and active plugin content are blocked by default by NS extension inside the Mozilla browser, so keep the NoScript/RequestPolicy extension visors up, (source of info: http://forums.informaction.com/viewtopic.php?f=8&t=4471 )
polonus
