NoScript failed me and left: what do I do now?

Reporting back after a successful nuking. I really appreciate the detailed advice on using non-destructive tools to diagnose and fix malware (thus the best answers), but I went for a full formatting and clean install because: 1) I just reinstalled a couple of weeks ago after a hard drive failure, so the process was pretty fresh in my mind and didn't take very long at all. I had Windows running happily with all patches and drivers within a couple of hours, and adding applications took a little more time. I'm going to image my install now, too, so the next time I have to wipe and replace should be even faster and easier. (All my data is kept on separate drives and backed up redundantly). 2) This is both my work machine, with some important client info on it, and the personal machine I use for online banking and some purchasing. My "incredible" amounts of banking = "any amount" of banking. Tracking down malware and similar varmints looks like a lot of fun as a puzzle and an intellectual challenge, but I have to balance that against my need to use my computer immediately with a high level of confidence in its security. I'm going to add some malware tools as added protection at runtime (as NoScript and MSE alone let this little bastard slip by), but when it comes to recovering my machine, it's sea of glass time, fast and easy.

For what it's worth as a tiny bit of reassurance.. I'm not on windows, but I had a noscript update on two of my machines this morning. So maybe that bit was real, and something about the update just borked the existing install? You should be able to check when they pushed their updates for windows somewhere. But I've no idea where exactly.

I can see on NoScript's http://noscript.net/changelog that the last update was 2.0.7, but I don't see a date and time. It's completely uninstalled: I checked the Add-Ons panel right away and it wasn't listed there.

Huh. Are you using a different FF profile than the one you were using before, an older one (or a brand new one) in which NoScript was never installed? Info on http://support.mozilla.com/en-US/kb/managing+profiles here.

Thanks for the links. I can confirm that I have only a single default profile. I've never heard of an update completely uninstalling NoScript, either, so even though I can't remember disabling, uninstalling or allowing global permissions in NoScript before I hit the site, that seems to be the only way that JavaScript could have run on the site and, possibly, killed NoScript. Or perhaps accepting a NoScript update while JS was running on the attack site was enough to kill it. I guess my main question is: how much can I trust my machine now? I will try to scan with the advised software, but as much of a pain as reinstalling is, the nuke from orbit plan is looking better. I don't think I can buy from Amazon or do online banking while I feel this insecure about my computer in its current state.

You can boot to Linux and run ClamAV (clamscan). There's a LiveCD just for this: http://www.volatileminds.net/opendiagnostics/index.php/OpenDiagnostics_Live_CD

Looking around, I did notice that last year, the guy who created NoScript http://hackademix.net/2009/06/24/net-clickonce-update-breaking-noscript-temporarily/ about an issue some people had with NoScript seemingly disappearing. Apparently the solution (at that time) was to uninstall the .NET Framework Assistant and fix the possibly corrupted FF extension files. Maybe that's all that happened here, the extension was corrupted? As far as nuking from orbit, I would consider that to be an extreme last resort to be used only after all other things have been exhausted, but I am not you and your threshold for broken trust may be lower.

Thanks for digging, Gator. I have a pile of .NET cruft installed, but just the 1.1 to 3.5 Frameworks and Service packs, no Assistant. His problem seemed to arise immediately after a Windows update, but maybe a similar weakness in NS made it vulnerable in the situation I described (installing an update while under attack). But I tried reinstalling NoScript and it came back fine, even remembering my previous settings, and I'll try some additional malware scans (MSE full scan came back absolutely clean). I still really don't like that a JS alert showed up at that site even with NS running, so I'm still not sure which way I'll jump after the next set of scans. Everything is running smoothly, no signs of browser hijacking, but still, I'm giving http://4.bp.blogspot.com/_D_Z-D2tzi14/TDFE5HnY9ZI/AAAAAAAADK8/bGcgfd9YqwE/s1600/Kellie20.png to my computer right now. Thanks!

I get those pop up alerts all the time on a couple sites I use for work. I thought they were a No Script feature? Applies you to toggle between clicks and has a very confusing OK button?