MyWebSearch spyware toolbar breaks the browser with a large grey bar at the bottom of the screen

RESOLVED FIXED

Status

()

Toolkit
Application Update
RESOLVED FIXED
12 years ago
9 years ago

People

(Reporter: Scott Burrows, Assigned: dveditz)

Tracking

({fixed1.8.0.2, fixed1.8.1})

unspecified
x86
Windows XP
fixed1.8.0.2, fixed1.8.1
Points:
---
Bug Flags:
blocking1.8.0.2 +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [rft-dl])

Attachments

(6 attachments, 2 obsolete attachments)

(Reporter)

Description

12 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

Large area under the status bar.  Appears the browser window is incorrectly placing the status bar.  There is a red upward facing arrow on the left side of the large area.  This bug is similar to but not the same as 309495 & 298874.  This first appeared after I upgraded from 1.0 to 1.5.  I have since uninstalled Firefox 3 times and reinstalled it and the area still appears.  

Reproducible: Always

Steps to Reproduce:
1. Open the browser, thats all.
2.
3.

Actual Results:  
Large area appears under the status bar.


This was not happening in prior version.  This may or may be playing a factor but on my machine my userid is XSXBTSO.  Because of a earlier non-browser related issue another account got created and it was named XSXBTSO.000, I don't know if the simliarities between account names is confusing it or not.
(Reporter)

Comment 1

12 years ago
Created attachment 205152 [details]
Shows the area under the status bar.
This may well be a duplicate of bug 314674 if you installed 1.5 over the top of 1.0.x. Does the problem occur in safe mode ? (http://kb.mozillazine.org/Safe_mode)

Comment 3

12 years ago
If this is still visible in safe mode, what exntension do you have installed?
(Reporter)

Comment 4

12 years ago
Created attachment 205218 [details]
Firefox in Safe mode.

Bringing Firefox up in Safemode does not appear to make a difference.
(Reporter)

Comment 5

12 years ago
I am not running with any extensions.  I added a new gif attachment of Firefox up in Safemode, no noticeable difference.  

Could the funky account situation I mentioned in the bug be playing a role?  Assumming not many others are seeing this I'm just wondering what is different about my setup.
(Reporter)

Comment 6

12 years ago
Another thing and this may be non-related but each time I initially bring up Firefox after a reboot my bookmarks toolbar does not display and the "rolling" icon that shows a page is being loaded does not stop.  If I kill Firefox and bring it back up then the toolbar appears and the icon stops "rolling".  This might be be a separate issue.
(Reporter)

Comment 7

12 years ago
The gif attachment demonstrates what I mean about the missing toolbar and rolling icon on when I fire up Firefox the first time after a reboot.
(Reporter)

Comment 8

12 years ago
I just realized something, I'm running with TalkBack 1.5, which is the crash reporting tool Firefox comes with.  I didn't realize it was installed as an extension.  Again starting up in Safemode made no difference.
Ok, could you perform some diagnostics please. 

1, Put about:config into to the location bar
2, Filter on javascript.options.showInConsole
3, Double-click so that that preference has value true
4, Restart Firefox
5, Copy any errors from Tools > Javascript console and paste into this bug. If there are alot of lines then paste into a file and attach that instead. Errors in both cases (before and after you have to kill Firefox after reboot) would be good if clearly identified.

I don't think the windows account issue is a big deal.
(Reporter)

Comment 10

12 years ago
Created attachment 205219 [details]
Firefox Chrome folder contents
(Reporter)

Comment 11

12 years ago
Created attachment 205220 [details]
Javascript Console entries.
(Reporter)

Comment 12

12 years ago
Nick,
I can see from your suggestion about the console that the Chrome theme seems to be corrupted.  I provided a gif of Chrome folder contents.  

Assumming the Chrome theme is the problem do I just delete the folder?  

BTW you rock bud, I didnt know I could look at the console to see what was going on.  Thanks!

Scott
Are those console errors from before you have to kill Firefox or after ? What series of steps did you perform before copying the console output. Looks like you went to about:config once (the navigator.properties and region.properties errors).

Chrome is actually a generic term meaning the UI of the application (the shiny stuff). What we're trying to do is figure out what happens to the chrome when 1.5 is installed over the top of 1.0.x (bug 314674). Since it isn't easy to reproduce this problem please do not delete anything out of the broken profile. To be getting on with you can create a new profile using the profile manager (http://kb.mozillazine.org/Profile_manager) and migrate your settings across (look for a migrate link at the url for the manager).
(Reporter)

Comment 14

12 years ago
Created attachment 205222 [details]
More defined error list.
(Reporter)

Comment 15

12 years ago
Nick,

Not sure what to tell you.  Now for some reason Firefox is always coming up correctly displaying my navigation toolbar and the icon is not rolling.

Initially the steps I took to show the errors were to turn on the ShowInConsole flag, shut down Firefox, restart it.  Click on Javascript console.

Interesting after looking at console again just now it added 3 new error lines after I clicked on email link to update this bug.  See attachment.

Scott
Scott, thanks for the additional info. Presumably the red arrow is still present even if the other problems have disappeared ?

We need to wait and see what Benjamin Smedberg can make of the Javascript console output now. The only references to m3ffxtbr I can find are a spyware program called MyWebSearch Toolbar.

Comment 17

12 years ago
Can you please zip the contents of your <installed-firefox-directory>/chrome/*.manifest folder and attach it?
(Reporter)

Comment 18

12 years ago
Created attachment 205229 [details]
Chrome folder MANIFEST files.
Attachment #205152 - Attachment is obsolete: true

Comment 19

12 years ago
OK, this is definitely spyware infestation, see http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453096424

I'll talk to the security group to decide whether/how Firefox should try to fix this.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: Large area under status bar showing red upward arrow. → MyWebSearch spyware toolbar breaks the browser with a large grey bar at the bottom of the screen
(Reporter)

Comment 20

12 years ago
Hmmm....I read the link about the Spyware and I'm not seeing a connection.  The link didn't mention anything about how it affects Firefox, if it even can.  No mention at all about it creating a area under the status bar.  The link said it affects toolbars at the top.

Ad-Aware finds no evidence of the MyWebSearch spyware on my machine.  Just in case AD-Aware was unable to detect it I did a search of my systems registry via RegEdit looking for the partial string:  "MyWeb".  No MyWebSearch hits.  

Just so I can learn, what leads you to believe its spyware?  

Yes the red arrow is still present.

Scott

Comment 21

12 years ago
The manifest files that were posted include m3ffxtbr.manifest, which is shipped by this piece of spyware. For some reason the spyware is broken, so instead of displaying a toolbar it displays an XML parsing error at the bottom of the screen.
(Reporter)

Comment 22

12 years ago
Benjamin,

Thanks for that info!

Will deleting that file help fix the problem?

Scott
(Reporter)

Comment 23

12 years ago
Never mind I can answer that.  I renamed the file m3ffxtbr.manifest to BAD-m3ffxtbe.manifest-BAD and restarted.  Problem gone!  

As far as I am concerned this bug can be closed.  

This might be a solution to put in a FAQ somewhere to aid others.

Scott

(Reporter)

Updated

12 years ago
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED

Comment 24

12 years ago
Scott, I think the devs. want to leave this open to decide what we're going to do if something like this arrises again.
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
(In reply to comment #21)
> The manifest files that were posted include m3ffxtbr.manifest, which is shipped
> by this piece of spyware. For some reason the spyware is broken, so instead of
> displaying a toolbar it displays an XML parsing error at the bottom of the
> screen.

I've helped half a dozen people with this bug in the last couple of days in #firefox. What do you think to adding chrome\m3ffxtbe.manifest to the list of files to be removed at install time ? Are there consquences to that ? 

*** Bug 327651 has been marked as a duplicate of this bug. ***

Comment 27

12 years ago
This is coming up often in the support forums, so I'm asking for blocking.
Flags: blocking1.8.0.2?
(Assignee)

Updated

12 years ago
Assignee: nobody → dveditz
Status: REOPENED → NEW
Flags: blocking1.8.0.2? → blocking1.8.0.2+
(Assignee)

Comment 28

12 years ago
Created attachment 212672 [details] [diff] [review]
remove broken toolbar
Attachment #212672 - Flags: review?(benjamin)
Attachment #212672 - Flags: approval1.8.0.2?
Attachment #212672 - Flags: approval-branch-1.8.1?(benjamin)

Updated

12 years ago
Attachment #212672 - Flags: review?(benjamin)
Attachment #212672 - Flags: review+
Attachment #212672 - Flags: approval1.8.0.2?
Attachment #212672 - Flags: approval1.8.0.2+
Attachment #212672 - Flags: approval-branch-1.8.1?(benjamin)
Attachment #212672 - Flags: approval-branch-1.8.1+
(Assignee)

Comment 29

12 years ago
Fixed on trunk, 1.8 and 1.8.0 branches
Status: NEW → RESOLVED
Last Resolved: 12 years ago12 years ago
Keywords: fixed1.8.0.2, fixed1.8.1
Resolution: --- → FIXED

Updated

12 years ago
Whiteboard: [rft-dl]
Someone might want to reopen this bug: it seems that the same spyware has reappeared with a slightly altered name.

See the thread started on news://news.mozilla.org/mozilla.support.firefox 19-Dec-2006 20:38 +0100 by Scot Ausborn under the title "FF 2.0 problems: Help menu, bookmarks, area below status bar" and how the problem was solved.
(In reply to comment #19)
> OK, this is definitely spyware infestation, see
> http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453096424
> 
> I'll talk to the security group to decide whether/how Firefox should try to fix
> this.
> 

That www3.ca.com page seems to have been withdrawn: I get a ca.com error page by trying to browse it.
Created attachment 249163 [details] [diff] [review]
proposed patch for mutated spyware

see comment #30
Attachment #249163 - Flags: review?(benjamin)
Attachment #249163 - Flags: approval1.8.1.2?
(Assignee)

Comment 33

11 years ago
(In reply to comment #30)
> Someone might want to reopen this bug: 

Please don't. I appreciate the effort, but this really ought to go in a new bug otherwise everyone gets confused -- is it fixed or not fixed? The original version is fixed, this mutation needs a new fix and a new bug.

Your initiative in tackling this is very much appreciated!
(In reply to comment #33)
> (In reply to comment #30)
> > Someone might want to reopen this bug: 
> 
> Please don't. I appreciate the effort, but this really ought to go in a new bug
> otherwise everyone gets confused -- is it fixed or not fixed? The original
> version is fixed, this mutation needs a new fix and a new bug.

Done. You should by now have received a couple of Bugzilla messages for bug 364460 (I put you on the CC list).

> 
> Your initiative in tackling this is very much appreciated!
> 

:) This is my first Mozilla patch. (The fix seemed obvious, after seeing how you had fixed this one.)
Comment on attachment 249163 [details] [diff] [review]
proposed patch for mutated spyware

This patch goes into bug 364460
Attachment #249163 - Attachment is obsolete: true
Attachment #249163 - Flags: review?(benjamin)
Attachment #249163 - Flags: approval1.8.1.2?
Product: Firefox → Toolkit
You need to log in before you can comment on or make changes to this bug.