Current versions of Firefox have no vulnerabilities that have exploits on the internet.
Here is a regurgitation from advice I gave in an older thread and I have added some additional information. But in short, you really can't currently get spyware through a new version of Firefox or Opera. If you switch and get it, then the spyware came from somewhere/something else. Here are the most likely culprits:
1) You didn't get your computer 100% clean before switching to Mozilla/Firefox or Opera. Spyware makers have gotten smart to spyware removal tools and they commonly utilize "sleeper" programs that do not get caught by the spyware removal tools. The sleeper routines nowadays are updated ***DAILY***. They go out and get a slightly modified but new copy of themselves every day. Therefore the definitions for spyware removal tools never detect the loader/sleeper routine. So in effect, as soon as you clean your machine, the next day the sleeper routing has fired up and re-downloaded all the junk to your machine again. Many true viruses are downloaders/sleepers/entry points for spyware. Only 2 ways to clean these: Leave the machine OFF the internet for about 2 weeks (long enough for spyware definitions to catch up), using another PC, download the spyware updates and put them on the infected machine with a floppy disk. The loader/sleeper program will be detected and removed. Either that or just reformat. Use antivirus to clean the true viruses from your machine.
2) You are still using IE on questionable sites. This does not NECESSARILY mean that the top level site you are going is not legit. It can also mean that the operators of that site (such as TBN for example) may inadvertently let an unsrupulous advertiser advertise. Their advertisement may link back to somewhere else that carries a spyware payload. So in effect, you can still be infected using IE on even credible, respected internet sites. All it takes is the marketing person to mess up and let one single ad slip through and be advertised on their credible site.
3) You may not be using IE, but may still be using other software that uses IE as the rendering engine. For example, some alternate browsers such as the Avant browser mentioned in this thread is just a pretty face for IE. It has all the same security issues. Or you may still be using outlook or outlook express as your email client. Web enabled email received in those browsers will still use IE as the rendering engine. So the same issues apply. Use Media Player Classic as an alternative to Windows Media Player, Quicktime, and Real Player. Do a search for "Quicktime Alternative", you will find it and it will bring media player classic with it.
4) You have a rootkit. That involves more than I am willing to type. Google for windows rootkit and do some research.
5) You are running a very old version of Mozilla/Firefox that has a security problem. New versions have no issues that allow spyware to install themselves in a manner that the user would not know about.
6) This is the worst one and can only be protected against with user education. Some spyware is USER initiated. In other words users are TRICKED into installing software that is either directly a spyware package, or carries a spyware package with it. It uses no security hole to install itself. It simply asks the unknowing user if they want to install X or Y software package and the unknowing user allows it to happen. Many so called FREE software packages fund themselves using this tactic. You want the software, so you also unknowingly agree to allow this other package to install itself as part of the deal... but you may not know exactly what you are agreeing to. Kazaa is an example of this... Free software that people want, yet it carries spyware with it. Many free software packages are not truly free. They most likely have a spyware component that the user ALLOWS to run.
Many web sites with multimedia content embed movies in the web page that automatically show the movie in the player of THEIR choice... meaning you can't download the content and choose your own viewer to view it in and it automatically uses Windows Media Player inside of the web browser (even if you go to the site with Firefox). These are potentially very dangerous. A work around is to disable WMP completely so that it errors out if a page attempts to use it, and then for these types of sites, make use of utilities such as the spiderzilla plugin for firefox. It lets you download the complete page (whether they want you to or not) then find the multimedia content file and view it in the viewer of your own choosing.
