1720738 - Malwarebytes blocking Firefox from opening

Status: RESOLVED WORKSFORME

(External Software Affecting Firefox :: Other, defect)

Description

[gbarr87]

Attachment: 56E03E14-BE5E-4CE5-9474-AC880F800135.png

User Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.1 Mobile/15E148 Safari/604.1

Steps to reproduce:

Tried to open Firefox from my desktop

Actual results:

Malwarebytes blocked the action reporting that there’s is a exploit via the addons feature. Report doesn’t tell me a specific addon is at fault

Expected results:

Firefox should have opened to the start homepage

Comment 1

[Toshihito Kikuchi [:toshi]]

Which version of Firefox are you using? Does the log file 7cd7313a-e586-11eb-b718-309c2300a394.json contain any useful information?

Comment 2

[gbarr87]

(In reply to Toshihito Kikuchi [:toshi] from comment #1)

Which version of Firefox are you using? Does the log file 7cd7313a-e586-11eb-b718-309c2300a394.json contain any useful information?

I was using version 90 at the time of my report. I then upgraded to beta version 91 (91.0.0.7876) and the problem briefly went away until today. Below is the Malwarebytes log file. I can't really tell whats going on.

71C93626F767DD3BE421E6219F90F6394CF2349649157C8BFB27FD5EC1B22378
{
"applicationVersion" : "4.4.2.123",
"chromeSyncResetQueryRequested" : false,
"chromeSyncResetQueryResult" : false,
"clientID" : "",
"clientType" : "other",
"componentsUpdatePackageVersion" : "1.0.1358",
"coreDllFileVersion" : "0.0.0",
"cpu" : "x64",
"dbSDKUpdatePackageVersion" : "1.0.43131",
"detectionDateTime" : "2021-07-15T16:05:44Z",
"fileSystem" : "NTFS",
"id" : "7cd7313a-e586-11eb-b718-309c2300a394",
"isUserAdmin" : true,
"licenseState" : "licensed",
"linkagePhaseComplete" : false,
"loggedOnUserName" : "System",
"machineID" : "",
"os" : "Windows 10 (Build 19042.1110)",
"schemaVersion" : 18,
"sourceDetails" : {
"type" : "ae"
},
"threats" : [
{
"ddsSigFileVersion" : "",
"linkedTraces" : [

     ],
     "mainTrace" : {
        "archiveMember" : "",
        "archiveMemberMD5" : "",
        "cleanAction" : "block",
        "cleanResult" : "successful",
        "cleanResultErrorCode" : 0,
        "cleanTime" : "2021-07-15T16:05:44Z",
        "exploitData" : {
           "appDisplayName" : "Mozilla Firefox (and add-ons)",
           "blockedFileName" : "",
           "documentFileName" : "",
           "layerText" : "Protection Against OS Security Bypass",
           "protectionTechnique" : "Exploit ROP gadget attack blocked",
           "url" : ""
        },
        "generatedByPostCleanupAction" : false,
        "hubbleRequestErrorCode" : 0,
        "id" : "82d95748-e586-11eb-bdaa-309c2300a394",
        "igExitCode" : "",
        "isPEFile" : false,
        "isPEFileValid" : false,
        "linkType" : "none",
        "objectMD5" : "",
        "objectPath" : "",
        "objectSha256" : "",
        "objectSize" : -1,
        "objectType" : "exploit",
        "resolvedPath" : ""
     },
     "ruleID" : 392684,
     "ruleString" : "",
     "rulesVersion" : "0.0.0",
     "srcEngineComponent" : "unknown",
     "srcEngineThreatNames" : [

     ],
     "threatID" : 0,
     "threatName" : "Malware.Exploit.Agent.Generic"
  }

],
"threatsDetected" : 1
}

Comment 3

[Toshihito Kikuchi [:toshi]]

Sorry for not responding for long. I reached out to Malwarebytes. I'll update this bug when I get any response from them.

Comment 4

[Gian-Carlo Pascutto [:gcp]]

gbarr, can you report this to MalwareBytes? They're often more responsive to their customers than they are to us. So far we didn't get any reply to our report, and there's nothing we really can do to fix this.

Comment 5

[gbarr87]

No worries guys, I'm just here trying to help out. I have no idea what was going on.

I got good news!! the recent download/update of Malwarebytes software let me open Firefox again. I dunno what happened seeing that my Firefox and Chrome have the same extension addons install, but it seems ok again. I'm running 92.0b5 now at it still opens

Comment 6

[Toshihito Kikuchi [:toshi]]

Thank you for the update. Resolving this bug as updating Malwarebytes solved the issue. Please let us know if the issue occurs again.