Firefox 3.6.15 Crash Report [@ CERT_DestroyCertificate ] with loaded spdg.dll, probably a malware

RESOLVED INCOMPLETE

Status

()

--
critical
RESOLVED INCOMPLETE
8 years ago
7 years ago

People

(Reporter: cbook, Unassigned)

Tracking

(Blocks: 1 bug, {crash})

Firefox Tracking Flags

(Not tracked)

Details

(crash signature, URL)

(Reporter)

Description

8 years ago
Firefox Crash for Firefox 3.6.15 https://crash-stats.mozilla.com/report/list?signature=CERT_DestroyCertificate

some startup crashes, might be the same user in this case and seem to happen in polish localizations or so ?

Crashing Thread
Frame 	Module 	Signature [Expand] 	Source
0 	nss3.dll 	CERT_DestroyCertificate 	security/nss/lib/certdb/stanpcertdb.c:750
1 	xul.dll 	CERTCertificateCleaner::~CERTCertificateCleaner 	security/manager/ssl/src/nsNSSIOLayer.cpp:112
2 	xul.dll 	AuthCertificateCallback 	security/manager/ssl/src/nsNSSCallbacks.cpp:1079
3 	ssl3.dll 	ssl3_HandleCertificate 	security/nss/lib/ssl/ssl3con.c:7905
4 	ssl3.dll 	ssl3_HandleHandshakeMessage 	security/nss/lib/ssl/ssl3con.c:8603
5 	ssl3.dll 	ssl3_HandleHandshake 	security/nss/lib/ssl/ssl3con.c:8727
6 	ssl3.dll 	ssl3_HandleRecord 	security/nss/lib/ssl/ssl3con.c:9066
7 	ssl3.dll 	ssl3_GatherCompleteHandshake 	security/nss/lib/ssl/ssl3gthr.c:209
8 	ssl3.dll 	ssl_GatherRecord1stHandshake 	security/nss/lib/ssl/sslcon.c:1258
9 	ssl3.dll 	ssl_Do1stHandshake 	security/nss/lib/ssl/sslsecur.c:151
10 	ssl3.dll 	ssl_SecureSend 	security/nss/lib/ssl/sslsecur.c:1213
11 	ssl3.dll 	ssl_SecureWrite 	security/nss/lib/ssl/sslsecur.c:1258
12 	ssl3.dll 	ssl_Write 	security/nss/lib/ssl/sslsock.c:1652
13 	xul.dll 	nsSSLThread::Run 	
14 	nspr4.dll 	_PR_NativeRunThread 	nsprpub/pr/src/threads/combined/pruthr.c:426
15 	nspr4.dll 	pr_root 	nsprpub/pr/src/md/windows/w95thred.c:122
16 	mozcrt19.dll 	_callthreadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:348
17 	mozcrt19.dll 	_threadstartex 	obj-firefox/memory/jemalloc/crtsrc/threadex.c:326
18 	kernel32.dll 	BaseThreadStart

Comment 1

8 years ago
stack is slightly different on frames 0,1,2 and 3, but is the same below as Bug 627716 - Crash on 4.0x [@ STAN_GetNSSCertificate ] with loaded spdg.dll, probably a malware.

is this the 3.x counterpart crash?

spdg.dll is around about 99% of the time on this one too.

checking --- CERT_DestroyCertificate 20110320-crashdata.csv
found in: 3.6.15 3.6.6 3.6.10 3.6.3 3.6.14 3.6.12 4.0 3.5.17 4.0b7 3.6.8 3.6 3.5.6 3.5.16 3.0.10
release total-crashes
              CERT_DestroyCertificate crashes
                         pct.
all     378366  319     0.000843099
3.6.15  167757  292     0.00174061
3.6.6   1890    4       0.0021164
3.6.10  3251    4       0.00123039
3.6.3   4764    3       0.000629723
3.6.14  2540    3       0.0011811
3.6.12  3107    3       0.000965562
4.0     105171  2       1.90166e-05
3.5.17  7538    2       0.000265322
4.0b7   2105    1       0.000475059
3.6.8   3644    1       0.000274424
3.6     3635    1       0.000275103
3.5.6   393     1       0.00254453
3.5.16  851     1       0.00117509
3.0.10  204     1       0.00490196

os breakdown
CERT_DestroyCertificateTotal 319
Win5.1  0.87
Win6.0  0.02
Win6.1  0.11

urls for testing
  48 \N
  34 about:blank
  28 about:sessionrestore
  12 https://nk.pl/login
  10 
   6 https://www.facebook.com/login.php?login_attempt=1
   6 http://www.google.pl/firefox?client=firefox-a&rls=org.mozilla:pl:official
   5 http://www.orkut.com/
   4 http://www.orkut.com.br/Home

Comment 2

8 years ago
not really sure how to arrange the dependency, but I'll just hook this one on to Bug 627716
Depends on: 627716
Summary: Firefox 3.6.15 Crash Report [@ CERT_DestroyCertificate ] → Firefox 3.6.15 Crash Report [@ CERT_DestroyCertificate ] with loaded spdg.dll, probably a malware
(Assignee)

Updated

8 years ago
Crash Signature: [@ CERT_DestroyCertificate ]

Updated

7 years ago
Blocks: 512788

Updated

7 years ago
Depends on: 716345

Comment 3

7 years ago
CERT_DestroyCertificate is now in the skiplist. I close it as incomplete.
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → INCOMPLETE
You need to log in before you can comment on or make changes to this bug.