649764 - crash [@ questbrwsearch.dll@0x2080]

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-2814ec49-2094-4d9b-b298-2e3882110412 .
============================================================= 

0 	questbrwsearch.dll 	questbrwsearch.dll@0x2080 	
1 	user32.dll 	__fnHkINLPRECT 	
2 	ntdll.dll 	KiUserCallbackDispatcher 	
3 	questbrwsearch.dll 	questbrwsearch.dll@0x207f 	
4 	xul.dll 	nsWindow::WindowProcInternal 	widget/src/windows/nsWindow.cpp:4614
5 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:71
6 		@0x14b00fff 	
7 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:65
8 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:71
9 	xul.dll 	xul.dll@0x35d7cd 	
10 	xul.dll 	nsWindow::WindowProc 	widget/src/windows/nsWindow.cpp:4561
11 	xul.dll 	xul.dll@0x1456cf 	
12 	user32.dll 	InternalCallWinProc 	
13 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:71
14 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:71
15 	user32.dll 	__fnINOUTLPSCROLLINFO 	
16 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:71
17 	user32.dll 	StringDuplicateW 	
18 	user32.dll 	UserCallWinProcCheckWow 	
19 	user32.dll 	DispatchMessageWorker 	
20 	xul.dll 	CallWindowProcCrashProtected 	xpcom/base/nsCrashOnException.cpp:71
21 	user32.dll 	NtUserPeekMessage 	
22 	user32.dll 	StringDuplicateW 	
23 	user32.dll 	StringDuplicateW 	
24 	user32.dll 	StringDuplicateW 	
25 	xul.dll 	xul.dll@0x35d7cd 	
26 	firefox.exe 	firefox.exe@0x1bb7 	
27 	kernel32.dll 	GetCodePageFileInfo 	
28 	kernel32.dll 	BaseProcessStart 	
29 	firefox.exe 	firefox.exe@0x186f 

Correlations:
100% (54/54) vs.   0% (109/61240) questbrwsearch.dll
54% (29/54) vs.   7% (4420/61240) msvcp60.dll
98% (53/54) vs.  54% (32874/61240) mpr.dll
74% (40/54) vs.  35% (21721/61240) cryptui.dll
65% (35/54) vs.  28% (17262/61240) rasman.dll
100% (54/54) vs.  65% (39667/61240) t2embed.dll
30% (16/54) vs.   1% (330/61240) clickpotatolitesahook.dll

96% (52/54) vs.   1% (470/61240) {D9ADB0A8-7BFB-498D-9880-EE78A81CCFA0}
33% (18/54) vs.   1% (735/61240) [e-mail]

This appeared first on 2011-04-11 as is rising fast on 4.0 since then (but
happening on 3.6 and even Thunderbird 3.1 as well), see https://crash-stats.mozilla.com/report/list?signature=questbrwsearch.dll%400x2080
for more reports. I wonder if this is related to bug 649760 - note that even the address of the crash in the DLL is the same!

Comment 1

[Robert Kaiser]

Given the possible connection with bug 649760 and this smelling like malware/adware to me, CCing Marcia and chofmann.

Comment 2

[chris hofmann]

Yeah,  looks bad...

http://www.virus-com.com/viruscom/viruscom_109944.html

How to remove questbrwsearch.dll

> 30% (16/54) vs.   1% (330/61240) clickpotatolitesahook.dll

http://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Adware%3AWin32%2FClickPotato

	 
Alert level
Adware:Win32/ClickPotato
(?)

Encyclopedia entry
Updated: Aug 23, 2010  |  Published: Aug 23, 2010

Aliases

    ADSPY/AdSpy.Gen2 (Avira)
    AdWare.AdSpy (Ikarus)
    Pinball (Sunbelt Software)

Comment 3

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/reply/question/etc.)]

I'm marking this bug as WORKSFORME as bug crashlog signature didn't appear from a long time (over half year).