519343 - Crash [@ NPFFAddOn.dll@0x11867]

Status: RESOLVED FIXED

(Firefox :: General, defect, P2)

Description

[Carsten Book [:Tomcat]]

seems this is a topcrash : NPFFAddOn.dll@0x11867

http://crash-stats.mozilla.com/report/list?product=Firefox&version=Firefox%3A3.5.3&query_search=signature&query_type=exact&query=&date=&range_value=1&range_unit=weeks&do_query=1&signature=NPFFAddOn.dll%400x11867

will investigate and see if i can reproduce this and get this malware, so assigning to me for the moment

Comment 1

[[:Cww]]

https://bugzilla.mozilla.org/show_bug.cgi?id=512122 FWIW

Comment 2

[Damon Sicore (:damons)]

Blocking 3.6+ per CrashKill effort.

Comment 3

[Mike Beltzner [:beltzner, not reading bugmail]]

Marking all topcrash bugs as P2 (3.6 release blockers, but not 3.6b1 blockers)

Comment 4

[Carsten Book [:Tomcat]]

so this should be fixed by bug 512122, but we still get crashes ?

Comment 5

[Carsten Book [:Tomcat]]

also see https://bugzilla.mozilla.org/show_bug.cgi?id=512406

Comment 6

[Dietrich Ayala (:dietrich)]

this comment specifically might be the reason why some people are still seeing this: https://bugzilla.mozilla.org/show_bug.cgi?id=512406#c15

are there other reasons why the blocklist might not get updated?

anyone familiar enough w/ the numbers to know if the instances of this crash (this is #12 topcrasher atm) could possibly be all from people who's blocklist wasn't updated for one reason or another?

Comment 7

[Damon Sicore (:damons)]

Carsten, the last crashkill meeting notes indicated that we need to get in touch with AV vendors.  Which ones?  I'm trying to create bugs to track them.

Comment 8

[Samuel Sidler (old account; do not CC)]

All of them. We need to tell them that we think this is malware and ask them to remove/quarantine this dll from users' systems.

Comment 9

[Mike Shaver (:shaver emeritus)]

If it's in the components directory, it will also be addressed by the compdir-lockdown.  Did the email get sent?

Comment 10

[Daniel Veditz [:dveditz] back 2026-04-08]

I'm pretty sure the A-V vendors will want a copy of the offending DLL -- that's
how I got nsBrowserOpt.dll beaten back. You put it in a zip encrypted with the
password "infected" (typically -- check for particulars) and submit it through
the A-V's web site or mailed to a submission address.

The first step is getting a copy of the DLL though. email addresses from
crash-stats may help, again that's how we dealt with nsBrowserOpt.dll. Failing
that maybe we can find a victim through one of the support avenues and get a
copy from them.

Comment 11

[Carsten Book [:Tomcat]]

Hi,

the Emails to the AV Vendors (51 vendors) is sent out (thanks Sam again!) and will update this bug when i get responses. 

Also yeah a sample of the dll would be cool.

Comment 14

[Mike Beltzner [:beltzner, not reading bugmail]]

While Johnath might not be the final owner for this, as the owner of the DLL blocklist and shepherd of component directory lockdownership, I think he may be best to drive it forward from this point on.

Comment 15

[Johnathan Nightingale [:johnath]]

Just resolved bug 525103 on trunk, which adds npffaddon.dll (all versions) to the DLL blocklist. My belief is that this should fix the issue for anyone using a version of Firefox with DLL blocklisting (any 3.6 version after today).

Pretty sure that resolves this bug, too. Can't load the DLL -> can't crash because of it.

Comment 16

[Johnathan Nightingale [:johnath]]

Should be fixed by checkin on bug 525103

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/74dfc0468e0a

Comment 17

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Tony, have you seen the crash while working on the blacklisting feature for this kind of add-on? If yes, can you verify that it has been fixed in 3.6b4?