Some Virus in FireFox Please Help

[badb0y]

OKAY! wow! i installed FireFox Stable, and the problem seem to be gone...

Thank you guys :D

but the problem i am facing with Nightly is not a Nightly problem...it still some kind of messed up registry entry or something else came from that exe file which i downloaded.

[+primortal Subscriber²]

Wonder if Sysinternal Process Monitor (http://technet.microsoft.com/en-us/sysinternals/bb896645) would help with what registry keys are being accessed when launching Firefox Nightly from a local HTML file.

[LaP]

Wonder if Sysinternal Process Monitor (http://technet.micro...ernals/bb896645) would help with what registry keys are being accessed when launching Firefox Nightly from a local HTML file.

Good idea

[+BudMan MVC]

So try going back to nightly - does the problem come back? If so I would check what registry changes happen when you install the nightly.

You could use something like http://sourceforge.net/projects/regshot/files/

Or can be done with just fc - just export your reg, then install nightly. Then export reg again and then compare with fc.exe /u one.reg two.reg >diff.txt

[badb0y]

It still happens on Nightly... i will try to monitor registry

[+BudMan MVC]

as to people using nightly and not having the issue, are you also running windows 8 like the OP?

[badb0y]

when i try to compare i get this :

C:\>fc.exe /1.reg 2.reg >diff.txt

FC: Insufficient number of file specifications

[+BudMan MVC]

well that not the right syntax

its fc.exe /u 1.reg 2.reg >diff.txt

not /1.reg

I believe you need the /u because reg files are unicode are they not? Let me do a simple test here on my xp box.

[badb0y]

thanks, i got this from the comparison:

Comparing files 1.reg and 2.REG

Resync Failed. Files are too different.

***** 1.reg

[HKEY_LOCAL_MACHINE\HARDWARE]

[HKEY_LOCAL_MACHINE\HARDWARE\ACPI]

[HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT]

[HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\_ASUS_]

[HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\_ASUS_\Notebook]

[HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\_ASUS_\Notebook\00000000]

"00000000"=hex:44,53,44,54,a3,06,01,00,01,46,5f,41,53,55,53,5f,4e,6f,74,65,62,\

6f,6f,6b,00,00,00,00,49,4e,54,4c,12,11,09,20,08,53,53,31,5f,0a,01,08,53,53,\

32,5f,0a,00,08,53,53,33,5f,0a,01,08,53,53,34,5f,0a,01,08,49,4f,53,54,0b,00,\

44,08,54,4f,50,4d,0c,ff,ff,ff,df,08,52,4f,4d,53,0c,00,00,e0,ff,08,4d,47,31,\

42,0c,00,00,00,00,08,4d,47,31,4c,0c,00,00,00,00,08,4d,47,32,42,0c,00,00,00,\

e0,08,4d,47,32,4c,0c,00,c0,50,1c,08,4d,43,48,42,0c,00,00,d1,fe,08,4d,43,48,\

4c,0b,00,40,08,45,47,50,42,0c,00,90,d1,fe,08,45,47,50,4c,0b,00,10,08,44,4d,\

49,42,0c,00,80,d1,fe,08,44,4d,49,4c,0b,00,10,08,49,46,50,42,0c,00,40,d1,fe,\

08,49,46,50,4c,0b,00,10,08,50,45,42,53,0c,00,00,00,f8,08,50,45,4c,4e,0c,00,\

00,00,04,08,54,54,54,42,0c,00,00,d2,fe,08,54,54,54,4c,0c,00,00,02,00,08,53,\

4d,42,53,0b,a0,ef,08,53,4d,42,4c,0a,10,08,50,42,4c,4b,0b,10,04,08,50,4d,42,\

53,0b,00,04,08,50,4d,4c,4e,0a,80,08,4c,56,4c,32,0b,14,04,08,4c,56,4c,33,0b,\

15,04,08,4c,56,4c,34,0b,16,04,08,53,4d,49,50,0a,b2,08,47,50,42,53,0b,00,05,\

08,47,50,4c,4e,0a,80,08,41,50,43,42,0c,00,00,c0,fe,08,41,50,43,4c,0b,00,10,\

08,50,4d,33,30,0b,30,04,08,53,52,43,42,0c,00,c0,d1,fe,08,53,52,43,4c,0b,00,\

40,08,53,55,53,57,0a,ff,08,48,50,54,42,0c,00,00,d0,fe,08,48,50,54,43,0c,04,\

f4,d1,fe,08,41,43,50,48,0a,de,08,41,53,53,42,0a,00,08,41,4f,54,42,0a,00,08,\

41,41,58,42,0a,00,08,50,45,48,50,0a,00,08,53,48,50,43,0a,01,08,50,45,50,4d,\

0a,00,08,50,45,45,52,0a,00,08,50,45,43,53,0a,00,08,49,54,4b,45,0a,00,08,44,\

53,53,50,0a,00,08,46,48,50,50,0a,01,08,46,4d,42,4c,0a,01,08,46,44,54,50,0a,\

02,08,46,55,50,53,0a,03,08,42,53,48,5f,0a,00,08,42,45,4c,5f,0a,01,08,42,45,\

48,5f,0a,02,08,42,52,48,5f,0a,03,08,42,54,46,5f,0a,04,08,42,48,43,5f,0a,05,\

08,42,59,42,5f,0a,06,08,42,50,48,5f,0a,07,08,42,53,48,53,0a,08,08,42,45,4c,\

53,0a,09,08,42,52,48,53,0a,0a,08,42,54,46,53,0a,0b,08,42,45,48,53,0a,0c,08,\

42,50,48,53,0a,0d,08,42,54,4c,5f,0a,10,08,42,53,52,5f,0a,14,08,42,53,43,5f,\

0a,1b,08,42,43,43,5f,0a,1c,08,42,4f,46,5f,0a,20,08,42,45,46,5f,0a,21,08,42,\

4c,4c,45,0a,22,08,42,4c,4c,43,0a,23,08,42,4c,43,41,0a,24,08,42,4c,4c,53,0a,\

25,08,42,4c,4c,50,0a,26,08,42,4c,4c,44,0a,27,08,42,48,42,45,0a,30,08,42,48,\

42,43,0a,31,08,42,48,42,4e,0a,32,08,42,48,42,4d,0a,33,08,54,52,54,50,0a,01,\

08,57,44,54,45,0a,01,08,54,52,54,44,0a,02,08,54,52,54,49,0a,03,08,47,43,44,\

44,0a,01,08,44,53,54,41,0a,0a,08,44,53,4c,4f,0a,0c,08,44,53,4c,43,0a,0e,08,\

50,49,54,53,0a,10,08,53,42,43,53,0a,12,08,53,41,4c,53,0a,13,08,4c,53,53,53,\

0a,2a,08,53,4f,4f,54,0a,35,08,50,44,42,52,0a,4d,08,4d,42,45,43,0a,00,08,4d,\

42,4c,46,0a,0a,5b,80,47,4e,56,53,00,0c,18,bc,79,df,0b,a8,01,5b,81,4a,3b,47,\

4e,56,53,10,4f,53,59,53,10,53,4d,49,46,08,50,52,4d,30,08,50,52,4d,31,08,53,\

43,49,46,08,50,52,4d,32,08,50,52,4d,33,08,4c,43,4b,46,08,50,52,4d,34,08,50,\

52,4d,35,08,50,38,30,44,20,4c,49,44,53,08,50,57,52,53,08,44,42,47,53,08,54,\

48,4f,46,08,41,43,54,31,08,41,43,54,54,08,50,53,56,54,08,54,43,31,56,08,54,\

43,32,56,08,54,53,50,56,08,43,52,54,54,08,44,54,53,45,08,44,54,53,31,08,44,\

54,53,32,08,44,54,53,46,08,00,38,52,45,56,4e,08,00,10,41,50,49,43,08,54,43,\

4e,54,08,50,43,50,30,08,50,43,50,31,08,50,50,43,4d,08,50,50,4d,46,20,43,36,\

37,4c,08,4e,41,54,50,08,43,4d,41,50,08,43,4d,42,50,08,4c,50,54,50,08,46,44,\

43,50,08,43,4d,43,50,08,43,49,52,50,08,53,4d,53,43,08,57,33,38,31,08,53,4d,\

43,31,08,49,47,44,53,08,54,4c,53,54,08,43,41,44,4c,08,50,41,44,4c,08,43,53,\

54,45,10,4e,53,54,45,10,53,53,54,45,10,4e,44,49,44,08,44,49,44,31,20,44,49,\

44,32,20,44,49,44,33,20,44,49,44,34,20,44,49,44,35,20,4b,53,56,30,20,4b,53,\

56,31,08,00,38,42,4c,43,53,08,42,52,54,4c,08,41,4c,53,45,08,41,4c,41,46,08,\

4c,4c,4f,57,08,4c,48,49,48,08,00,08,45,4d,41,45,08,45,4d,41,50,10,45,4d,41,\

4c,10,00,08,4d,45,46,45,08,44,53,54,53,08,00,10,54,50,4d,50,08,54,50,4d,45,\

08,4d,4f,52,44,08,54,43,47,50,08,50,50,52,50,20,50,50,52,51,08,4c,50,50,52,\

08,47,54,46,30,38,47,54,46,32,38,49,44,45,4d,08,47,54,46,31,38,42,49,44,5f,\

08,00,48,08,41,53,4c,42,20,49,42,54,54,08,49,50,41,54,08,49,54,56,46,08,49,\

54,56,4d,08,49,50,53,43,08,49,42,4c,43,08,49,42,49,41,08,49,53,53,43,08,49,\

34,30,39,08,49,35,30,39,08,49,36,30,39,08,49,37,30,39,08,49,50,43,46,08,49,\

44,4d,53,08,49,46,31,45,08,48,56,43,4f,08,4e,58,44,31,20,4e,58,44,32,20,4e,\

58,44,33,20,4e,58,44,34,20,4e,58,44,35,20,4e,58,44,36,20,4e,58,44,37,20,4e,\

58,44,38,20,47,53,4d,49,08,50,41,56,50,08,00,08,4f,53,43,43,08,4e,45,58,50,\

08,53,42,56,31,08,53,42,56,32,08,00,30,44,53,45,4e,08,45,43,4f,4e,08,47,50,\

49,43,08,43,54,59,50,08,4c,30,31,43,08,56,46,4e,30,08,56,46,4e,31,08,56,46,\

4e,32,08,56,46,4e,33,08,56,46,4e,34,08,00,48,05,4e,56,47,41,20,4e,56,48,41,\

20,41,4d,44,41,20,44,49,44,36,20,44,49,44,37,20,44,49,44,38,20,45,42,41,53,\

20,43,50,53,50,20,45,45,43,50,20,45,56,43,50,20,58,42,41,53,20,4f,42,53,31,\

20,4f,42,53,32,20,4f,42,53,33,20,4f,42,53,34,20,4f,42,53,35,20,4f,42,53,36,\

20,4f,42,53,37,20,4f,42,53,38,20,00,48,05,41,54,4d,43,08,50,54,4d,43,08,41,\

54,52,41,08,50,54,52,41,08,50,4e,48,4d,20,54,42,41,42,20,54,42,41,48,20,52,\

54,49,50,08,54,53,4f,44,08,41,54,50,43,08,50,54,50,43,08,50,46,4c,56,08,42,\

52,45,56,08,53,47,4d,44,08,53,47,46,4c,08,50,57,4f,4b,08,48,4c,52,53,08,44,\

53,45,4c,08,45,53,45,4c,08,50,53,45,4c,08,50,57,45,4e,08,50,52,53,54,08,4d,\

58,44,31,20,4d,58,44,32,20,4d,58,44,33,20,4d,58,44,34,20,4d,58,44,35,20,4d,\

58,44,36,20,4d,58,44,37,20,4d,58,44,38,20,47,42,41,53,10,00,28,41,4c,46,50,\

08,49,4d,4f,4e,08,50,44,54,53,08,50,4b,47,41,08,50,41,4d,54,08,41,43,30,46,\

08,41,43,31,46,08,44,54,53,33,08,44,54,53,34,08,52,53,56,32,08,52,53,56,33,\

08,10,87,5c,05,5c,5f,53,42,5f,08,50,52,30,30,12,43,23,23,12,0f,04,0c,ff,ff,\

01,00,0a,00,4c,4e,4b,41,0a,00,12,0f,04,0c,ff,ff,01,00,0a,01,4c,4e,4b,42,0a,\

00,12,0f,04,0c,ff,ff,01,00,0a,02,4c,4e,4b,43,0a,00,12,0f,04,0c,ff,ff,01,00,\

0a,03,4c,4e,4b,44,0a,00,12,0f,04,0c,ff,ff,06,00,0a,00,4c,4e,4b,44,0a,00,12,\

0f,04,0c,ff,ff,06,00,0a,01,4c,4e,4b,41,0a,00,12,0f,04,0c,ff,ff,06,00,0a,02,\

4c,4e,4b,42,0a,00,12,0f,04,0c,ff,ff,06,00,0a,03,4c,4e,4b,43,0a,00,12,0f,04,\

0c,ff,ff,04,00,0a,00,4c,4e,4b,41,0a,00,12,0f,04,0c,ff,ff,04,00,0a,01,4c,4e,\

4b,42,0a,00,12,0f,04,0c,ff,ff,04,00,0a,02,4c,4e,4b,43,0a,00,12,0f,04,0c,ff,\

ff,04,00,0a,03,4c,4e,4b,44,0a,00,12,0f,04,0c,ff,ff,1f,00,0a,02,4c,4e,4b,43,\

0a,00,12,0f,04,0c,ff,ff,1f,00,0a,03,4c,4e,4b,41,0a,00,12,0f,04,0c,ff,ff,1b,\

00,0a,00,4c,4e,4b,47,0a,00,12,0f,04,0c,ff,ff,18,00,0a,00,4c,4e,4b,45,0a,00,\

12,0f,04,0c,ff,ff,19,00,0a,00,4c,4e,4b,45,0a,00,12,0f,04,0c,ff,ff,16,00,0a,\

00,4c,4e,4b,41,0a,00,12,0f,04,0c,ff,ff,16,00,0a,01,4c,4e,4b,44,0a,00,12,0f,\

04,0c,ff,ff,16,00,0a,02,4c,4e,4b,43,0a,00,12,0f,04,0c,ff,ff,16,00,0a,03,4c,\

4e,4b,42,0a,00,12,0f,04,0c,ff,ff,1f,00,0a,00,4c,4e,4b,46,0a,00,12,0f,04,0c,\

ff,ff,1f,00,0a,01,4c,4e,4b,44,0a,00,12,0f,04,0c,ff,ff,1d,00,0a,00,4c,4e,4b,\

***** 2.REG

[HKEY_LOCAL_MACHINE\DRIVERS]

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase]

"Version"=dword:06020000

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds]

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*6to4mp]

"nettun.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AEI0276]

"mdmmetri.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AEI9240]

"mdmti.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AIW1038]

"mdmaiwa4.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AKY00A1]

"mdmrock5.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AKY1001]

"mdmrock5.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AKY1005]

"mdmrock5.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AKY1009]

"mdmracal.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AKY1013]

"mdmmetri.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*ANX2101]

"mdmrock4.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AZT4001]

"mdmzyxel.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AZT4004]

"mdmzyxel.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AZT4017]

"mdmzyxel.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*AZT4021]

"mdmcpq.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*BDP0156]

"mdmzoom.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*BDP2336]

"mdmrock4.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*BDP3336]

"mdmzoom.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*BRI1400]

"mdmboca.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*BRI3400]

"mdmboca.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*BRI9400]

"mdmrock4.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*BRIB400]

"mdmrock4.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPI4050]

"mdmati.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQA0D2]

"wave.inf"=hex:02,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQA0D4]

"wave.inf"=hex:02,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQA0D6]

"wave.inf"=hex:02,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQA0E1]

"wave.inf"=hex:02,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQA0E2]

"wave.inf"=hex:02,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQA0E4]

"wave.inf"=hex:02,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQB01D]

"mdmcpq2.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQB05C]

"mdmcpq.inf"=hex:01,ff,00,00

[HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DeviceIds\*CPQB0EF]

"mdmcpq2.inf"=hex:01,ff,00,00

*****

[+BudMan MVC]

well you got some sort of error there - saying too different?

Might be better off using the regshot software I linked too

I did a simple test changing that key we have been looking at changing it to %2 vs %1 and could see the change in the text file

***** one.reg

[HKEY_USERS\S-1-5-21-3397983210-2267950855-1181551349-14068_Classes\FirefoxHTML\shell\open\command]

@="\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""

***** TWO.REG

[HKEY_USERS\S-1-5-21-3397983210-2267950855-1181551349-14068_Classes\FirefoxHTML\shell\open\command]

@="\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%2\""

*****

[+Gary7 Subscriber²]

It seems after all of these posts trying to help you that this problem is not resolved. You have been given just about every possible fix. You can try to format and re install. If you remove all traces of Firefox and then reinstall it, it should work. Anuy problems I have ever had were fixed ny just creating a new profile. I have been using it since it was called Phoenix.

[+BudMan MVC]

It seems after all of these posts trying to help you that this problem is not resolved.

Not true it was resolved when he went to stable

"OKAY! wow! i installed FireFox Stable, and the problem seem to be gone..."

Then he went back to nightly and problem came back - trying to figure out what is causing it now. He has not stated what specific nightly he is using, nor do we know if the other users using the nightly that say they are not having the issue are using windows 8 like the OP?

[xendrome]

Maybe try this? http://www.crystalidea.com/uninstall-firefox

[Detection]

An addon not compatible with nightly but fine with stable ?

[LaP]

An addon not compatible with nightly but fine with stable ?

Could very well be the case.

nightly = beta after all.

[nub]

A. Are you sure this is a Firefox issue? It could just be opening your default browser which is set to Firefox. You could try changing your default browser and see what happens.

B. What plugins (and/or extensions) do you have installed?

Edit: I did not see that install Firefox stable fixed the issue. Ignore me!

More info: I'm running latest nightly and Windows 8. Opening a file named "Removed Apps.html" (on my dekstop) opens "file:///C:/Users/Me/Desktop/Removed" and "http://www.apps.html/". It seems to be an issue with spaces in file names.

https://bugzilla.mozilla.org/show_bug.cgi?id=841548