Alex wrote:

dko wrote:Problem:. With "Monitor flash downloads in browsers" enabled the above versions upon closing leave firefox running in memory.

Hello,

Unfortunately we were unable to reproduce the issue.
Could you please provide us with additional info? For this, please follow these steps.
1. Reproduce the issue.
2. Start task manager, find such firefox.exe process, right click it and choose "Create Dump File".
3. Send created dump file to our support with "Details for ticket #5118" subject.

Thanks.

Hi Alx,

I followed your clear exact instructions and I have sent you a separate email with screen dumps of what I see in Windows task Manager BUT I cannot send the requested Firefox.DMP as it is 345MB (even compressed to .7z it is still a massive 71MB). and the email address providers cannot handle that size.

I therefore have No idea how to comply.

Usher's suggestion of trying with flvsniff.dll (version1040) WORKS in as much as it does NOT stop Firefox 39 closing properly and being released from memory whilst version 1058 breaks Firefox 39 Beta.
I accept your team cannot recreate the issue on your PCs but my finding over the last 24 hours are 100% consistent trying each of the two versions of flvsniff.dll.

Logic says (well mine anyway ) says what was changed to get flvsniff.dll to work for XP/IE users (I recall) broke Firefox closing properly on my Win 7 (x64) PC (and I assume other Win ((x64) users as well when they start using same O/s and Firefox 39 Beta).

I will be happy to try/test anything you ask me to do, in order to help your team trace and resolve issue.

Kind Regards

Please download and run Process Explorer.
It can create mini-dumps. Run it, find a process, right click it and choose Create Dump | Create Minidump.
This one should be much smaller in size.

Usher wrote:

Alex wrote:

Usher wrote:FDM plugin for IE still causes random crashes on IE8 start as described earlier (opening only single tab window; no main iexplore.exe process running, no toolbar etc.; crash in ieframe.dll module).

Could you please send the crash dump?

Just sent to support (at).

Hello,

We've analyzed the report you sent and found nothing related to FDM in it.

Could you please try to test without FDM installed?

We also noted that several system files in your OS including iexplore.exe seems to be altered by some way (there we no symbols found for them on Microsoft Symbol server). This can be the reason too.

It seems it's just UI bug of IE8.
I remember that it was not stable for me also. Even with no FDM installed at all.

Alex wrote:We've analyzed the report you sent and found nothing related to FDM in it.
Could you please try to test without FDM installed?

I can test IE8 with monitoring turned off in FDM.

Alex wrote:We also noted that several system files in your OS including iexplore.exe seems to be altered by some way (there we no symbols found for them on Microsoft Symbol server). This can be the reason too.

What files? Name them and I will name proper KB numbers. Maybe you should look at updates for Windows 2003 Server and POSReady 2009 also, not only for Windows XP?

Alex wrote:It seems it's just UI bug of IE8.
I remember that it was not stable for me also. Even with no FDM installed at all.

Microsoft describes it as a problem with IE extensions, not just IE8 bug. That's why I turned off almost all IE extensions. Only Microsoft ones, FDM extensions (normal and video monitoring) and flash player are enabled in my IE.

Usher wrote:What files? Name them and I will name proper KB numbers. Maybe you should look at updates for Windows 2003 Server and POSReady 2009 also, not only for Windows XP?

We use Microsoft Symbol server. I'm pretty sure they store all the symbols for the all files they issued ever.
That's why I supposed your system could be altered by some malware / something else.

The file list is:

C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\normaliz.dll
C:\WINDOWS\system32\xpsp2res.dll
C:\WINDOWS\system32\msv1_0.dll
C:\WINDOWS\system32\iphlpapi.dll
C:\WINDOWS\system32\ieui.dll
C:\WINDOWS\system32\msasn1.dll
C:\WINDOWS\system32\msls31.dll

Alex wrote:We use Microsoft Symbol server. I'm pretty sure they store all the symbols for the all files they issued ever. That's why I supposed your system could be altered by some malware / something else.

The files are from WIndows XP in Polish language version. Microsoft in the past removed updates and other data for non-supported Windows, starting from non-English versions so they possibly did it again. If you don't believe me, you can go here: http://windows.microsoft.com/en-us/wind ... ffline-faq and try to download Windows Live Essentials for Windows XP in any language listed there.

All listed files are from original Microsoft updates, installed using Windows Update and unchanged, compared with files unpacked from original update installers, digitally signed by Microsoft.

* Windows XP SP2 original files:
C:\WINDOWS\system32\xpsp2res.dll - 5.1.2600.5512, dated 2008-04-14
C:\WINDOWS\system32\iphlpapi.dll - 5.1.2600.5512, dated 2008-04-14

* IE8 original files, from IE8-WindowsXP-x86-PLK.exe :
C:\WINDOWS\system32\normaliz.dll - 6.0.5441.0 (winmain(wmbla).060628-1735), dated 2009-01-07,
C:\Program Files\Internet Explorer\iexplore.exe - 8.0.6001.18702, dated 2009-03-08, digitally signed by Microsoft
C:\WINDOWS\system32\ieui.dll - 8.0.6001.18702, dated 2009-03-08
C:\WINDOWS\system32\msls31.dll - 3.10.349.0, dated 2009-03-08

* KB974571:
C:\WINDOWS\system32\msasn1.dll - 5.1.2600.5875, dated 2009-09-04

* KB975467:
C:\WINDOWS\system32\msv1_0.dll - 5.1.2600.5876, dated 2009-09-11

Alex wrote:Please download and run Process Explorer.
It can create mini-dumps. Run it, find a process, right click it and choose Create Dump | Create Minidump.
This one should be much smaller in size.

Hi Alex ,
Not sure what time period you are operating under. About 15-16 hours ago I uploaded my FULL firefox.DMP via the sharing site you recommended in you email to me and then I sent you an email immediately afterwards with the link to enable you to download it.

BEFORE, I do a Process Explorer mini Dump I am hoping you (or your team) are now in possession of that file I uploaded. Please can you confirm whether you have that file now.

Many thanks

dko, we got it, thanks.

D. Yessa wrote:dko, we got it, thanks.

Terrific!
Thanks for such a fast reply. Hope it helps.
If you need any further info, dumps (or whatever) please just ask.

Kind regards

dko wrote:Problem:. With "Monitor flash downloads in browsers" enabled the above versions upon closing leave firefox running in memory.

I believe it's a bug of Malwarebytes Anti-Exploit. Its component mbae.dll prevents Firefox from shutting down.

Alex wrote:

dko wrote:Problem:. With "Monitor flash downloads in browsers" enabled the above versions upon closing leave firefox running in memory.

I believe it's a bug of Malwarebytes Anti-Exploit. Its component mbae.dll prevents Firefox from shutting down.

Hi Alex, Thanks for the info.

I reinstalled flvsniff.dll (version 1058) and re-enabled " Monitor flash downloads in browsers" to test your belief.
I noted that in Windows Task Manager there were 3 Malwarebytes Anti-Exploit exes running
mbae64.exe
mbae.exe *32
mbae-svc.exe

I then opened and closed Firefox several times to confirm Firefox was not closing properly. I was NOT (as reported to you)

I then terminated all 3 MBAE Exes via Windows Task Manager and then opened and closed Firefox several times. I confirm that Firefox 39.0b (beta) closed normally every time

I then rebooted PC and closed ONLY mbae-svc.exe (leaving mbae64.exe & mbae.exe *32 still running)
I then opened and closed Firefox several times and THIS TIME Firefox closing properly again Every time
This suggests the conflict is something to do with mbae-svc.exe or something it uses

I have no Idea whether the 2 still open work properly with mbae-svc.exe closed., (all automatically run at Windows start up).
I believe (looking at MBAE Forum) mbae-svc.exe accesses the Internet at each Window's start-up to check for MBAE updates and installs and runs them, if found.

NOW MY QUESTION Alex (please do not think I am not being cheeky). Why do you feel this problem is a Bug in MBAE?

I ask because:
With Firefox 38.0.1 (and before), FDM 3.9.6 Build 1459 Plug-in 1.7.3.2 with flvsniff.dll (VERSION 1058) AND MBAE.
All Worked Together correctly and Firefox 38.01 closed perfectly EVERY TIME

Bring in Firefox 38.05 and 39.01b and FDM Plug-in no longer works at all for downloads.
Ignoring this fact as I assume that is a different issue due to Firefox changes), please note the following findings:

With Firefox 39.01b, FDM 3.9.6 Build 1549 Plug-in 1.7.3.2 with flvsniff.dll (VERSION 1040) AND MBAE
Firefox 39.01b closes perfectly EVERY TIME

With Firefox 39 Beta, FDM3.9.6 Build 1549 Plug-in 1.7.3.2 with flvsniff.dll (VERSION 1058) AND MBAE
Firefox fails to close properly EVERY TIME.

Forgive me but the odd one out seems to be flvsniff.dll (version 1058).

Of course have no idea if it is a bug in MBAE's mbae.dll, as you suggest that is Exposed by
flvsniff.dll (version 1058) BUT NOT BY flvsniff.dll (Version 1040)

I respectfully ask could it be a bug that has crept into flvsniff.dll (version 1058) which did not exist in flvsniff.dll (Version 1040) and it has triggered something in MBAE's mbae.dll and/or Firefox which stops Firefox 390.1b closing properly EVERY TIME.

Then again, could it be neither FDM or MBAE being really to blame, but Firefox 39.0.1b (and 38.0.5) with one of its new changes. After all, BOTH FDM3.9.6 Build 1549 Plug-in 1.7.3.2, and MBAE worked with Firefox 38.0.1 when I was using flvsniff.dll (version 1058)

If I am being honest Alex, as flvsniff.dll (VERSION 1040) does NOT interfere with Firefox 39.0.1b closing down, I have to say MY logic for what its worth (probably not a lot ) suggests its a change in flvsniff.dll (version 1058) is more liely the culprit (than Firefox & MBAE).
This seems a classic "Which came first the chicken or the egg".
I feel sure Firefox will not change their app as they decide what they want, and as far as I know MBAE has not changed their app recently. The only salient change that I know of is flvsniff.dll from version 1040 (which works changed to version1058 that does not work with a Firefox 39.0.1b & MBAE combination.

If it truly is MBAE fault and only theirs, then of course I am prepared to remove MBAE (as FDM is much more important to me) but naturally I would prefer not to do so, as a level of protection on my PC would go with it.

I am sure I have been very long winded Alex and other readers, and I apologize. Nevertheless I hope this info is of help.

Kind regards

dko wrote:I then rebooted PC and closed ONLY mbae-svc.exe (leaving mbae64.exe & mbae.exe *32 still running)
I then opened and closed Firefox several times and THIS TIME Firefox closing properly again Every time
This suggests the conflict is something to do with mbae-svc.exe or something it uses

It's expected result. File mbae-svc.exe runs core Malwarebytes services (scanning, monitoring, blocking etc.), files mbae64.exe and mbae.exe*32 are only parts of Malwarebytes GUI. If you close them, services will be still active.

dko wrote:With Firefox 38.0.1 (and before), FDM 3.9.6 Build 1459 Plug-in 1.7.3.2 with flvsniff.dll (VERSION 1058) AND MBAE.
All Worked Together correctly and Firefox 38.01 closed perfectly EVERY TIME
Bring in Firefox 38.05 and 39.01b and FDM Plug-in no longer works at all for downloads.

I suspect that Malwarebytes developers read about Mozilla Extension SIgning and implemented some overzealous checking that was not intended by Firefox developers, that is - blocking some files rather then warning proposed by Mozilla. Note that Mozilla announced implementing signature checking also for files downloaded by embedded Firefox downloader:
http://news.softpedia.com/news/Mozilla- ... 2663.shtml

I think you should stop Firefox beta testing now. FDM developers already started works on Extension Signing so it is better to wait for implementing this feature in FDM.

Usher wrote:

dko wrote:I then rebooted PC and closed ONLY mbae-svc.exe (leaving mbae64.exe & mbae.exe *32 still running)
I then opened and closed Firefox several times and THIS TIME Firefox closing properly again Every time
This suggests the conflict is something to do with mbae-svc.exe or something it uses

It's expected result. File mbae-svc.exe runs core Malwarebytes services (scanning, monitoring, blocking etc.), files mbae64.exe and mbae.exe*32 are only parts of Malwarebytes GUI. If you close them, services will be still active.

dko wrote:With Firefox 38.0.1 (and before), FDM 3.9.6 Build 1459 Plug-in 1.7.3.2 with flvsniff.dll (VERSION 1058) AND MBAE.
All Worked Together correctly and Firefox 38.01 closed perfectly EVERY TIME
Bring in Firefox 38.05 and 39.01b and FDM Plug-in no longer works at all for downloads.

I suspect that Malwarebytes developers read about Mozilla Extension SIgning and implemented some overzealous checking that was not intended by Firefox developers, that is - blocking some files rather then warning proposed by Mozilla. Note that Mozilla announced implementing signature checking also for files downloaded by embedded Firefox downloader:
http://news.softpedia.com/news/Mozilla- ... 2663.shtml

I think you should stop Firefox beta testing now. FDM developers already started works on Extension Signing so it is better to wait for implementing this feature in FDM.

Hi Usher thanks for the info. I too wondered about what you are suggesting about " mbae-svc.exe"

On the 2nd point I am unsure:
I now you are correct about the Extension Signing and I understand the ability to disable the checking is only available to Firefox Nightly Testers where the checking exists in Development versions. From what I understand when it gets to release NO user will be able to disable and all add-ons etc. that fail the check will be totally blocked without a temporary User workaround. I suspect that will cause a lot of mayhem bearing in mind many add-on authors are not active or hardly active.

I have one question however Usher on your suspicion. IF MBAE is over zealously blocking some files would it not block flvsniff.dll Ver 1040 (as well as flvsniff.dll ver 1058). Clearly MBAE is not blocking Ver. 1040. I still feel there is something unique in flvsniff.dll Ver 1058 that was not in Ver. 1040 and that MBAE is not the primary culprit for my issue BUT I COULD EASILY BE WRONG.

Am I correct that, as I am not a XP user that there is no reason why I cannot just use flvsniff.dll Ver 1040 or is Ver 1058 supposed to address other issues that would affect me if I do not use it.

I know it would only be your opinion (and nothing more) but do you have any personal view on the merit of retaining and using MBAE. I must admit I am not totally convinced about how it integrates with Systems anyway (and in my case it has never found an exploit attempt) in 2 months (Maybe my Avast! (free) and Comodo Firewall got to them first ) I know Hitman Pro's similar offering does not play nice and I think is a little buggy currently. Maybe both are overlapping what Avast and others AV apps are already incorporating in their offers.

You may well be correct about abandoning Firefox Betas form now on, but as 38.0.5 was also problematic with this flvsniff.dll issue It would only resolve THIS issue for a few weeks.
I think if Mozilla is not very careful, they will lose a lot of Users soon, OR they will find Users sticking with a current release for a long time and ignoring future releases. I say this because I think E10 and Extension checking will be a nightmare for ALL who like add-ons and have many (like me). Add-ons and customization were one of Firefox's greatest attractions. With these changes the Add-on authors cannot or will not want to keep up (too much hard work in many cases). IMHO

Kind regards Usher.