Closed Bug 641766 Opened 9 years ago Closed 8 years ago

Crash mainly at startup [@ McFFPlg.dll@0x1c757 ][@ McFFPlg.dll@0x1cb20 ][@ McFFPlg.dll@0x24700 ][@ McFFPlg.dll@0x1c5bd ][@ McFFPlg.dll@0x1f49a ] with McAfee Site Advisor 3.3.1 or below and Zango adware

Categories

(Plugins Graveyard :: McAfee AV, defect, critical)

x86
Windows 7
defect
Not set
critical

Tracking

(Not tracked)

RESOLVED WORKSFORME

People

(Reporter: scoobidiver, Unassigned)

References

Details

(Keywords: crash, topcrash, user-doc-needed)

Crash Data

It is a residual crash signature in 3.6 and 4.0RC1.
It is #83 top crasher in 4.0RC1.

Signature	McFFPlg.dll@0x1cb20
UUID	a0ecf6ca-525c-4435-b841-94cd72110314
Time 	2011-03-14 11:13:48.792300
Uptime	7105
Last Crash	7221 seconds (2.0 hours) before submission
Install Age	7105 seconds (2.0 hours) since version was first installed.
Product	Firefox
Version	4.0
Build ID	20110303194838
Branch	2.0
OS	Windows NT
OS Version	6.1.7600
CPU	x86
CPU Info	AuthenticAMD family 16 model 5 stepping 3
Crash Reason	EXCEPTION_ACCESS_VIOLATION_READ
Crash Address	0xd
User Comments	
App Notes 	AdapterVendorID: 1002, AdapterDeviceID: 9498, AdapterDriverVersion: 8.741.0.0
D2D? D2D+
DWrite? DWrite+
D3D10 Layers? D3D10 Layers+

Frame 	Module 	Signature [Expand] 	Source
0 	McFFPlg.dll 	McFFPlg.dll@0x1cb20 	
1 	McFFPlg.dll 	McFFPlg.dll@0x1fe7d 	
2 	McFFPlg.dll 	McFFPlg.dll@0x1be47 	
3 	mcbrwctl.dll 	mcbrwctl.dll@0x39cee 	
4 	mcbrwctl.dll 	mcbrwctl.dll@0x39f70 	
5 	mcbrwctl.dll 	mcbrwctl.dll@0x3d8c9 	
6 	McFFPlg.dll 	McFFPlg.dll@0x1e65d 	
7 	McFFPlg.dll 	McFFPlg.dll@0x1e9fa 	
8 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
9 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1613
10 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4799
11 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
12 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
13 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:2206
14 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4799
15 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
16 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
17 	mozjs.dll 	js::InvokeSessionGuard::invoke 	js/src/jsinterpinlines.h:604
18 	mozjs.dll 	array_extra 	js/src/jsarray.cpp:2857
19 	mozjs.dll 	array_forEach 	js/src/jsarray.cpp:2914
20 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4799
21 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
22 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
23 	mozjs.dll 	js_fun_apply 	js/src/jsfun.cpp:2206
24 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4799
25 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
26 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
27 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:863
28 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5173
29 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1672
30 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:588
31 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
32 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
33 	xul.dll 	nsBrowserStatusFilter::OnStateChange 	toolkit/components/statusfilter/nsBrowserStatusFilter.cpp:183
34 	xul.dll 	nsDocLoader::FireOnStateChange 	uriloader/base/nsDocLoader.cpp:1334
35 	xul.dll 	nsDocLoader::doStopDocumentLoad 	uriloader/base/nsDocLoader.cpp:953
36 	xul.dll 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:818
37 	xul.dll 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:702
38 	xul.dll 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:680
39 	xul.dll 	xul.dll@0xb3fdf3 	
40 	xul.dll 	nsDocLoader::Stop 	uriloader/base/nsDocLoader.cpp:329
41 	xul.dll 	nsDocShell::Stop 	docshell/base/nsDocShell.cpp:4263
42 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102
43 	xul.dll 	XPC_WN_CallMethod 	js/src/xpconnect/src/xpcwrappednativejsops.cpp:1613
44 	mozjs.dll 	js::Interpret 	js/src/jsinterp.cpp:4799
45 	mozjs.dll 	js::RunScript 	js/src/jsinterp.cpp:653
46 	mozjs.dll 	js::Invoke 	js/src/jsinterp.cpp:740
47 	mozjs.dll 	js::ExternalInvoke 	js/src/jsinterp.cpp:863
48 	mozjs.dll 	JS_CallFunctionValue 	js/src/jsapi.cpp:5173
49 	xul.dll 	nsXPCWrappedJSClass::CallMethod 	js/src/xpconnect/src/xpcwrappedjsclass.cpp:1672
50 	xul.dll 	nsXPCWrappedJS::CallMethod 	js/src/xpconnect/src/xpcwrappedjs.cpp:588
51 	xul.dll 	PrepareAndDispatch 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:114
52 	xul.dll 	SharedStub 	xpcom/reflect/xptcall/src/md/win32/xptcstubs.cpp:141
53 	xul.dll 	NS_InvokeByIndex_P 	xpcom/reflect/xptcall/src/md/win32/xptcinvoke.cpp:102

More reports at:
https://crash-stats.mozilla.com/report/list?range_value=4&range_unit=weeks&signature=McFFPlg.dll%400x1cb20

4.0RC1 correlations by module version give:
    100% (85/85) vs.   1% (611/68732) McSACorePS.dll
        100% (85/85) vs.   1% (429/68732) 3.3.0.109
    100% (85/85) vs.   1% (649/68732) mcbrwctl.dll
        100% (85/85) vs.   1% (447/68732) 3.3.0.176
    100% (85/85) vs.   1% (665/68732) McFFPlg.dll
        100% (85/85) vs.   1% (461/68732) 3.3.0.153
    100% (85/85) vs.   2% (1532/68732) sahook.dll
        100% (85/85) vs.   1% (647/68732) 3.3.0.176
Bug 637542 is on file to blocklist this version of Site Advisor.
Blocks: 637
Summary: Crash with McAfee Site Advisor 3.3 [@ McFFPlg.dll@0x1cb20 ], mainly at startup → Crash with McAfee Site Advisor 3.3.0 [@ McFFPlg.dll@0x1cb20 ], mainly at startup
No longer blocks: 637
Depends on: 637542
Yes this is looking and sounding like exactly what is happening to my browser. So what do I need to do next then?
> So what do I need to do next then?
Disable the McAfee Site Advisor extension or update it to version 3.3.1.
[@ McBrwCtl.dll@0x2439b ] is another crash that affects the 3.6.x branch that seems to be related to the same Site Advisor product, but a different version.
According to correlations in 4.0, there have been no crashes with versions 3.3.1.* of these modules.
Three days after the add-on blocklisting of versions 3.3.0 and below, there are still crashes with versions 3.3.0.* but the blocklist needs time to propagate.
Summary: Crash with McAfee Site Advisor 3.3.0 [@ McFFPlg.dll@0x1cb20 ], mainly at startup → Crash with McAfee Site Advisor 3.3.0 [@ McFFPlg.dll@0x1cb20 ][@ McFFPlg.dll@0x1c757 ] mainly at startup
Could it be that people are crashing so early in startup that they will not get a new blocklist at all?
Keywords: topcrash
> Could it be that people are crashing so early in startup that they will not get
> a new blocklist at all?
It is not the extension that makes Firefox crash, but McAfee's software, so whatever the add-on blocklist status, it will crash.
We must wait McAfee's automatic update to see these crashes go.
We're now tracking such bugs. This doesn't mean it's something we can fix, merely something we hope to be able to point vendors to so they can investigate. This is an automated message.
Status: NEW → UNCONFIRMED
Component: Extension Compatibility → McAfee AV
Ever confirmed: false
Product: Firefox → Plugins
QA Contact: extension.compatibility → mcafee-antivirus
Version: Trunk → unspecified
According to correlations, it happens also with version 3.3.1.
Summary: Crash with McAfee Site Advisor 3.3.0 [@ McFFPlg.dll@0x1cb20 ][@ McFFPlg.dll@0x1c757 ] mainly at startup → Crash with McAfee Site Advisor 3.3.1 and below [@ McFFPlg.dll@0x1cb20 ][@ McFFPlg.dll@0x1c757 ] mainly at startup
there is a high correlation between many of these McFFPlg.dll crashes and 
the loading of sahook.dll.   might be a marker that malware is installed in many of these cases.

sahook found in 26501 of 481152 total crash reports for firefox 4 on 3/28/11
 sahook.dll might be associated with Adware.Zango.AN   
installed in:
- \bin\[versionnr]\[install-name]SAHook.dll 
other references:  
http://www.bitdefender.com/VIRUS-1000200-en--Adware.Zango.AN.html

McFFPlg.dll@0x1c757|EXCEPTION_ACCESS_VIOLATION_READ (1850 crashes)	     
  99% (1828/1850) vs.   6% (26501/481152) sahook.dll

McFFPlg.dll@0x1cb20|EXCEPTION_ACCESS_VIOLATION_READ (1777 crashes)
  99% (1767/1777) vs.   6% (26501/481152) sahook.dll

McFFPlg.dll@0x24700|EXCEPTION_ACCESS_VIOLATION_READ (554 crashes) 
  99% (549/554) vs.   6% (26501/481152) sahook.dll

McFFPlg.dll@0x1c5bd|EXCEPTION_ACCESS_VIOLATION_READ (66 crashes)
  97% (64/66) vs.   6% (26501/481152) sahook.dll

McFFPlg.dll@0x1f49a|EXCEPTION_ACCESS_VIOLATION_READ (43 crashes)
  98% (42/43) vs.   6% (26501/481152) sahook.dll
more on Adware.Zango.AN and Seekmo Search Assistant (sa hook)
http://www.f-secure.com/sw-desc/adware__zango.shtml
http://www.spamlaws.com/zango-adware.html
we could also try the e-mail responder to let about 800 people a day know whats going on.
Keywords: user-doc-needed
Summary: Crash with McAfee Site Advisor 3.3.1 and below [@ McFFPlg.dll@0x1cb20 ][@ McFFPlg.dll@0x1c757 ] mainly at startup → Crash mainly at startup [@ McFFPlg.dll@0x1c757 ][@ McFFPlg.dll@0x1cb20 ][@ McFFPlg.dll@0x24700 ][@ McFFPlg.dll@0x1c5bd ][@ McFFPlg.dll@0x1f49a ] with McAfee Site Advisor 3.3.1 or below and Zango adware
Version: unspecified → 3.x
bp-870d6f2b-55f7-478f-aa6b-82f332110401

I use McAfee with SiteAdvisor—thought I'd add my voice here. It's Firefox 4·0's first crash on this machine (first crash in 12 days).

Firefox 4 had been running well (with SiteAdvisor) since installation, so it was a surprise to see there might still be a continuing issue.
looks like the continuing issue might only involve the combination of SiteAdvisor + malware that its trying to combat, or is unable to detect.
Interesting, Chris. I have had a total scan of the system only on Friday, but will run Spybot and a few others to see what else they pick up.
Crash Signature: [@ McFFPlg.dll@0x1c757 ] [@ McFFPlg.dll@0x1cb20 ] [@ McFFPlg.dll@0x24700 ] [@ McFFPlg.dll@0x1c5bd ] [@ McFFPlg.dll@0x1f49a ]
There have been no crashes with signatures containing McFFPlg.dll for the last four weeks.
I close it as WFM.
Status: UNCONFIRMED → RESOLVED
Crash Signature: [@ McFFPlg.dll@0x1c757 ] [@ McFFPlg.dll@0x1cb20 ] [@ McFFPlg.dll@0x24700 ] [@ McFFPlg.dll@0x1c5bd ] [@ McFFPlg.dll@0x1f49a ] → [@ McFFPlg.dll@0x1c757 ] [@ McFFPlg.dll@0x1cb20 ] [@ McFFPlg.dll@0x24700 ] [@ McFFPlg.dll@0x1c5bd ] [@ McFFPlg.dll@0x1f49a ]
Closed: 8 years ago
Resolution: --- → WORKSFORME
Product: Plugins → Plugins Graveyard
You need to log in before you can comment on or make changes to this bug.