Last Comment Bug 319319 - MyWebSearch spyware toolbar breaks the browser with a large grey bar at the bottom of the screen
: MyWebSearch spyware toolbar breaks the browser with a large grey bar at the b...
Status: RESOLVED FIXED
[rft-dl]
: fixed1.8.0.2, fixed1.8.1
Product: Toolkit
Classification: Components
Component: Application Update (show other bugs)
: unspecified
: x86 Windows XP
: -- normal (vote)
: ---
Assigned To: Daniel Veditz [:dveditz]
:
: Robert Strong [:rstrong] (use needinfo to contact me)
Mentors:
: 327651 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2005-12-06 09:29 PST by Scott Burrows
Modified: 2008-07-31 04:30 PDT (History)
12 users (show)
dveditz: blocking1.8.0.2+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
Shows the area under the status bar. (49.53 KB, image/gif)
2005-12-06 09:33 PST, Scott Burrows
no flags Details
Firefox in Safe mode. (39.02 KB, image/gif)
2005-12-07 05:13 PST, Scott Burrows
no flags Details
Firefox Chrome folder contents (32.83 KB, image/gif)
2005-12-07 05:53 PST, Scott Burrows
no flags Details
Javascript Console entries. (2.59 KB, text/plain)
2005-12-07 05:55 PST, Scott Burrows
no flags Details
More defined error list. (1.95 KB, text/plain)
2005-12-07 06:41 PST, Scott Burrows
no flags Details
Chrome folder MANIFEST files. (1.79 KB, application/octet-stream)
2005-12-07 09:10 PST, Scott Burrows
no flags Details
remove broken toolbar (614 bytes, patch)
2006-02-21 17:43 PST, Daniel Veditz [:dveditz]
benjamin: review+
benjamin: approval‑branch‑1.8.1+
benjamin: approval1.8.0.2+
Details | Diff | Splinter Review
proposed patch for mutated spyware (362 bytes, patch)
2006-12-19 15:14 PST, Tony Mechelynck [:tonymec]
no flags Details | Diff | Splinter Review

Description Scott Burrows 2005-12-06 09:29:00 PST
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

Large area under the status bar.  Appears the browser window is incorrectly placing the status bar.  There is a red upward facing arrow on the left side of the large area.  This bug is similar to but not the same as 309495 & 298874.  This first appeared after I upgraded from 1.0 to 1.5.  I have since uninstalled Firefox 3 times and reinstalled it and the area still appears.  

Reproducible: Always

Steps to Reproduce:
1. Open the browser, thats all.
2.
3.

Actual Results:  
Large area appears under the status bar.


This was not happening in prior version.  This may or may be playing a factor but on my machine my userid is XSXBTSO.  Because of a earlier non-browser related issue another account got created and it was named XSXBTSO.000, I don't know if the simliarities between account names is confusing it or not.
Comment 1 Scott Burrows 2005-12-06 09:33:52 PST
Created attachment 205152 [details]
Shows the area under the status bar.
Comment 2 Nick Thomas [:nthomas] 2005-12-06 09:41:03 PST
This may well be a duplicate of bug 314674 if you installed 1.5 over the top of 1.0.x. Does the problem occur in safe mode ? (http://kb.mozillazine.org/Safe_mode)
Comment 3 José Jeria 2005-12-06 14:38:19 PST
If this is still visible in safe mode, what exntension do you have installed?
Comment 4 Scott Burrows 2005-12-07 05:13:01 PST
Created attachment 205218 [details]
Firefox in Safe mode.

Bringing Firefox up in Safemode does not appear to make a difference.
Comment 5 Scott Burrows 2005-12-07 05:16:56 PST
I am not running with any extensions.  I added a new gif attachment of Firefox up in Safemode, no noticeable difference.  

Could the funky account situation I mentioned in the bug be playing a role?  Assumming not many others are seeing this I'm just wondering what is different about my setup.
Comment 6 Scott Burrows 2005-12-07 05:20:59 PST
Another thing and this may be non-related but each time I initially bring up Firefox after a reboot my bookmarks toolbar does not display and the "rolling" icon that shows a page is being loaded does not stop.  If I kill Firefox and bring it back up then the toolbar appears and the icon stops "rolling".  This might be be a separate issue.
Comment 7 Scott Burrows 2005-12-07 05:24:01 PST
The gif attachment demonstrates what I mean about the missing toolbar and rolling icon on when I fire up Firefox the first time after a reboot.
Comment 8 Scott Burrows 2005-12-07 05:29:33 PST
I just realized something, I'm running with TalkBack 1.5, which is the crash reporting tool Firefox comes with.  I didn't realize it was installed as an extension.  Again starting up in Safemode made no difference.
Comment 9 Nick Thomas [:nthomas] 2005-12-07 05:32:40 PST
Ok, could you perform some diagnostics please. 

1, Put about:config into to the location bar
2, Filter on javascript.options.showInConsole
3, Double-click so that that preference has value true
4, Restart Firefox
5, Copy any errors from Tools > Javascript console and paste into this bug. If there are alot of lines then paste into a file and attach that instead. Errors in both cases (before and after you have to kill Firefox after reboot) would be good if clearly identified.

I don't think the windows account issue is a big deal.
Comment 10 Scott Burrows 2005-12-07 05:53:37 PST
Created attachment 205219 [details]
Firefox Chrome folder contents
Comment 11 Scott Burrows 2005-12-07 05:55:16 PST
Created attachment 205220 [details]
Javascript Console entries.
Comment 12 Scott Burrows 2005-12-07 05:58:48 PST
Nick,
I can see from your suggestion about the console that the Chrome theme seems to be corrupted.  I provided a gif of Chrome folder contents.  

Assumming the Chrome theme is the problem do I just delete the folder?  

BTW you rock bud, I didnt know I could look at the console to see what was going on.  Thanks!

Scott
Comment 13 Nick Thomas [:nthomas] 2005-12-07 06:11:53 PST
Are those console errors from before you have to kill Firefox or after ? What series of steps did you perform before copying the console output. Looks like you went to about:config once (the navigator.properties and region.properties errors).

Chrome is actually a generic term meaning the UI of the application (the shiny stuff). What we're trying to do is figure out what happens to the chrome when 1.5 is installed over the top of 1.0.x (bug 314674). Since it isn't easy to reproduce this problem please do not delete anything out of the broken profile. To be getting on with you can create a new profile using the profile manager (http://kb.mozillazine.org/Profile_manager) and migrate your settings across (look for a migrate link at the url for the manager).
Comment 14 Scott Burrows 2005-12-07 06:41:51 PST
Created attachment 205222 [details]
More defined error list.
Comment 15 Scott Burrows 2005-12-07 06:42:51 PST
Nick,

Not sure what to tell you.  Now for some reason Firefox is always coming up correctly displaying my navigation toolbar and the icon is not rolling.

Initially the steps I took to show the errors were to turn on the ShowInConsole flag, shut down Firefox, restart it.  Click on Javascript console.

Interesting after looking at console again just now it added 3 new error lines after I clicked on email link to update this bug.  See attachment.

Scott
Comment 16 Nick Thomas [:nthomas] 2005-12-07 08:15:43 PST
Scott, thanks for the additional info. Presumably the red arrow is still present even if the other problems have disappeared ?

We need to wait and see what Benjamin Smedberg can make of the Javascript console output now. The only references to m3ffxtbr I can find are a spyware program called MyWebSearch Toolbar.
Comment 17 Benjamin Smedberg [:bsmedberg] 2005-12-07 08:22:51 PST
Can you please zip the contents of your <installed-firefox-directory>/chrome/*.manifest folder and attach it?
Comment 18 Scott Burrows 2005-12-07 09:10:10 PST
Created attachment 205229 [details]
Chrome folder MANIFEST files.
Comment 19 Benjamin Smedberg [:bsmedberg] 2005-12-07 09:52:10 PST
OK, this is definitely spyware infestation, see http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453096424

I'll talk to the security group to decide whether/how Firefox should try to fix this.
Comment 20 Scott Burrows 2005-12-07 10:48:34 PST
Hmmm....I read the link about the Spyware and I'm not seeing a connection.  The link didn't mention anything about how it affects Firefox, if it even can.  No mention at all about it creating a area under the status bar.  The link said it affects toolbars at the top.

Ad-Aware finds no evidence of the MyWebSearch spyware on my machine.  Just in case AD-Aware was unable to detect it I did a search of my systems registry via RegEdit looking for the partial string:  "MyWeb".  No MyWebSearch hits.  

Just so I can learn, what leads you to believe its spyware?  

Yes the red arrow is still present.

Scott
Comment 21 Benjamin Smedberg [:bsmedberg] 2005-12-07 10:50:56 PST
The manifest files that were posted include m3ffxtbr.manifest, which is shipped by this piece of spyware. For some reason the spyware is broken, so instead of displaying a toolbar it displays an XML parsing error at the bottom of the screen.
Comment 22 Scott Burrows 2005-12-07 11:28:54 PST
Benjamin,

Thanks for that info!

Will deleting that file help fix the problem?

Scott
Comment 23 Scott Burrows 2005-12-07 11:33:32 PST
Never mind I can answer that.  I renamed the file m3ffxtbr.manifest to BAD-m3ffxtbe.manifest-BAD and restarted.  Problem gone!  

As far as I am concerned this bug can be closed.  

This might be a solution to put in a FAQ somewhere to aid others.

Scott

Comment 24 Adam Guthrie 2005-12-08 09:59:26 PST
Scott, I think the devs. want to leave this open to decide what we're going to do if something like this arrises again.
Comment 25 Nick Thomas [:nthomas] 2006-01-27 15:01:07 PST
(In reply to comment #21)
> The manifest files that were posted include m3ffxtbr.manifest, which is shipped
> by this piece of spyware. For some reason the spyware is broken, so instead of
> displaying a toolbar it displays an XML parsing error at the bottom of the
> screen.

I've helped half a dozen people with this bug in the last couple of days in #firefox. What do you think to adding chrome\m3ffxtbe.manifest to the list of files to be removed at install time ? Are there consquences to that ? 

Comment 26 Nick Thomas [:nthomas] 2006-02-17 13:00:13 PST
*** Bug 327651 has been marked as a duplicate of this bug. ***
Comment 27 Jason Barnabe (np) 2006-02-19 11:44:58 PST
This is coming up often in the support forums, so I'm asking for blocking.
Comment 28 Daniel Veditz [:dveditz] 2006-02-21 17:43:26 PST
Created attachment 212672 [details] [diff] [review]
remove broken toolbar
Comment 29 Daniel Veditz [:dveditz] 2006-02-26 10:27:21 PST
Fixed on trunk, 1.8 and 1.8.0 branches
Comment 30 Tony Mechelynck [:tonymec] 2006-12-19 14:25:57 PST
Someone might want to reopen this bug: it seems that the same spyware has reappeared with a slightly altered name.

See the thread started on news://news.mozilla.org/mozilla.support.firefox 19-Dec-2006 20:38 +0100 by Scot Ausborn under the title "FF 2.0 problems: Help menu, bookmarks, area below status bar" and how the problem was solved.
Comment 31 Tony Mechelynck [:tonymec] 2006-12-19 14:48:00 PST
(In reply to comment #19)
> OK, this is definitely spyware infestation, see
> http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453096424
> 
> I'll talk to the security group to decide whether/how Firefox should try to fix
> this.
> 

That www3.ca.com page seems to have been withdrawn: I get a ca.com error page by trying to browse it.
Comment 32 Tony Mechelynck [:tonymec] 2006-12-19 15:14:06 PST
Created attachment 249163 [details] [diff] [review]
proposed patch for mutated spyware

see comment #30
Comment 33 Daniel Veditz [:dveditz] 2006-12-19 21:25:31 PST
(In reply to comment #30)
> Someone might want to reopen this bug: 

Please don't. I appreciate the effort, but this really ought to go in a new bug otherwise everyone gets confused -- is it fixed or not fixed? The original version is fixed, this mutation needs a new fix and a new bug.

Your initiative in tackling this is very much appreciated!
Comment 34 Tony Mechelynck [:tonymec] 2006-12-20 05:38:56 PST
(In reply to comment #33)
> (In reply to comment #30)
> > Someone might want to reopen this bug: 
> 
> Please don't. I appreciate the effort, but this really ought to go in a new bug
> otherwise everyone gets confused -- is it fixed or not fixed? The original
> version is fixed, this mutation needs a new fix and a new bug.

Done. You should by now have received a couple of Bugzilla messages for bug 364460 (I put you on the CC list).

> 
> Your initiative in tackling this is very much appreciated!
> 

:) This is my first Mozilla patch. (The fix seemed obvious, after seeing how you had fixed this one.)
Comment 35 Tony Mechelynck [:tonymec] 2006-12-20 05:42:11 PST
Comment on attachment 249163 [details] [diff] [review]
proposed patch for mutated spyware

This patch goes into bug 364460

Note You need to log in before you can comment on or make changes to this bug.