Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Avast! false positives killed my Firefox


  • Please log in to reply
16 replies to this topic

#1 intron

intron

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 01:38 PM

Hello and thanks in advance for any advice.

I am using WinXP SP3.

I had the latest version of Avast! Home and was running Online Armor firewall from Tall Emu.

As everyone knows by now, Avast released a bad program update that labeled everything with a False Positive. Many systems were killed - especially when people had automatic responses to virus alerts set.

I set it to ask me about each occurrence. First thing to pop us as a FP for me were two dll files from my Online Armor. I quarantined them. Then lots of other things started popping up (Spybot stuff, Acrobat, etc). It made my computer unusable because of all the popups. I went to a second computer and searched around until I figured out what was happening. I unquarantined the files and disabled Avast! But things were still slow. Everything was creeping and if the monitor shut down in power save I couldn't wake it. Also, Firefox and IE wouldn't run for more than a few minutes without crashing.

I uninstalled Avast. No change.

I uninstalled Online Armor. No change.

I downloaded a 'clean uninstall' program from the Avast website which is run in safe mode and is supposed to get rid of any bits of the software that do not uninstall with add/remove.

I ran Malwarebytes and Spybot. They found nothing.

I decided to reinstall graphics drivers on a whim - sure enough, my computer sped up to what seems to be normal speed and I no longer have the issue of the monitor not waking up.

I reinstalled FF - it still won't run.

I have found what is happening with FF - when I open it, it starts eating memory and within about a minute Task Manager reports that it has used about 1.5GB of RAM!!!! Of course, it slows the system until FF crashes.

IE isn't doing the same thing but I have found that when I open IE, 2 instances of it appear in the Task Manager - I don't remember this happening before. I can actually use IE for about 5 minutes before it crashes.

I got Opera on a flash drive and installed it after the Avast! fiasco - it works fine. Thunderbird also works fine.

Now, I use this computer each and every day intensively at work. I am very familiar with it. These things were NOT happening before the Avast! update issue. I have no idea where to go from here. Any ideas?

Thanks so much!

Mark

BC AdBot (Login to Remove)

 


#2 JamesFrance

JamesFrance

  • Members
  • 283 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:France/Spain
  • Local time:09:32 PM

Posted 07 December 2009 - 01:57 PM

Maybe you could try uninstalling Firefox and installing it again? If a vital component has been removed that could replace it.
James

#3 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 02:05 PM

Maybe you could try uninstalling Firefox and installing it again? If a vital component has been removed that could replace it.



Does Firefox leave your user profile information in place when it uninstalls? I haven't done that yet because I wasn't 100% sure.

#4 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 02:06 PM

Aren't the interwebs amazing:

http://kb.mozillazine.org/Uninstalling_Firefox

"Starting in Firefox 3, the uninstaller includes the option, "Remove my Firefox personal data and customizations". This will also remove your Firefox user profile data (bookmarks, passwords, cookies, extensions, preferences, etc.). DO NOT select this option if you want to keep your Firefox profile data and settings."

#5 JamesFrance

JamesFrance

  • Members
  • 283 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:France/Spain
  • Local time:09:32 PM

Posted 07 December 2009 - 02:19 PM

You could also use a program called Mozbackup, I use it to transfer my changes to my laptop when I go away. It will back up anything you chose for Firefox or Thunderbird.
James

#6 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 02:36 PM

Nope, that isn't it. Before I even got firefox to open up fully it jumped up to over 1GB of memory used. I killed it.

Man, this is no fun. Usually if I have a computer problem I have at least some idea of where to go but I don't here.

I did a system restore to a point before the update but it didn't fix anything.

thanks again for your helpful replies. Hopefully I can get this figured out some time soon.

#7 xblindx

xblindx

  • Banned
  • 1,923 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:32 PM

Posted 07 December 2009 - 08:01 PM

Try using a temporary file cleaner such as CCleaner

If that doesn't help, try using Revo Uninstaller to uninstall firefox. This program removes all traces of the program from the registry and any left over files. Be sure to backup your registry before running it. select the last option (Advanced) during uninstallation of firefox.

#8 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 09:08 PM

Try using a temporary file cleaner such as CCleaner

If that doesn't help, try using Revo Uninstaller to uninstall firefox. This program removes all traces of the program from the registry and any left over files. Be sure to backup your registry before running it. select the last option (Advanced) during uninstallation of firefox.



Ok, will try.

Just as an update, I stared FF in safemode using the command:

"%PROGRAMFILES%\Mozilla Firefox\firefox.exe" -safe-mode

I just started FF and then let it sit on my home page - Google. I dind't load any other pages or touch it in any way. It started at around 59mb and then after a minute it had crept up to about 61mb and was hovering there, then dropped to about 50mb after about 5 minutes. SOooooo I went playing. I opened 4 webpages and the memory usage shot to 250mb, which is better but still seems high. Then I opened 10 CNN.com pages - it shot to 300. I closed all but 1 Cnn.com page and let it sit for another 5 minutes - now it was up to 350mb and climbing.

Its better but something is still clearly wrong. Again, I didn't have any issues at all before the Avast! fiasco, which makes me want to avoid them for a while. Its a shame, I just finished changing the A/V programs on all my computers from AVG to Avast! Luckily, only one is ever turned off so the updated did not affect them.

Thanks again for the suggestions, I am continuing the search and will try what you recommend.

#9 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 09:47 PM

Just installed an add-on from Mozilla called "Leak Monitor".... as soon as I restarted FF it gave me a "memory leak notification" with the following results. Apparently all javascript functions held over from some previous time??


Leaks in window 0x80900e0:
[+] [leaked object] (90fd540) = [HTMLDocument]
[ ] evaluate (8021ab8) = [Function]
[ ] createExpression (8021af0) = [Function]
[ ] createNSResolver (8021b28) = [Function]
[ ] baseURI = true
[ ] textContent = true
[ ] compareDocumentPosition (8021d90) = [Function]
[ ] getUserData (8021dc8) = [Function]
[ ] isSameNode (8021e00) = [Function]
[ ] lookupNamespaceURI (8021e38) = [Function]
[ ] setUserData (8021e70) = [Function]
[ ] lookupPrefix (8021ea8) = [Function]
[ ] isDefaultNamespace (8021ee0) = [Function]
[ ] isEqualNode (8021f18) = [Function]
[ ] documentURI = true
[ ] adoptNode (8021d20) = [Function]
[ ] renameNode (8021d58) = [Function]
[ ] dispatchEvent (8021f50) = [Function]
[ ] removeEventListener (802c000) = [Function]
[ ] createNodeIterator (802c038) = [Function]
[ ] defaultView = true
[ ] createEvent (802c070) = [Function]
[ ] activeElement = true
[ ] getElementsByClassName (802c0a8) = [Function]
[ ] hasFocus (802c0e0) = [Function]
[ ] elementFromPoint (802c118) = [Function]
[ ] getBoxObjectFor (802c150) = [Function]
[ ] width = true
[ ] height = true
[ ] domain = true
[ ] designMode = true
[ ] getSelection (802c188) = [Function]
[ ] body = true
[ ] anchors = true
[ ] links = true
[ ] title = true
[ ] URL = true
[ ] referrer = true
[ ] forms = true
[ ] cookie = true
[ ] images = true
[ ] getElementsByName (802c1c0) = [Function]
[ ] documentElement = true
[ ] implementation = true
[ ] doctype = true
[ ] getElementsByTagName (802c1f8) = [Function]
[ ] getElementsByTagNameNS (802c230) = [Function]
[ ] getElementById (802c268) = [Function]
[ ] createDocumentFragment (802c2a0) = [Function]
[ ] createElement (802c2d8) = [Function]
[ ] importNode (802c310) = [Function]
[ ] createTextNode (802c348) = [Function]
[ ] nextSibling = true
[ ] firstChild = true
[ ] prefix = true
[ ] nodeValue = true
[ ] childNodes = true
[ ] nodeName = true
[ ] namespaceURI = true
[ ] previousSibling = true
[ ] nodeType = true
[ ] localName = true
[ ] lastChild = true
[ ] ownerDocument = true
[ ] parentNode = true
[ ] attributes = true
[ ] appendChild (802c380) = [Function]
[ ] cloneNode (802c3b8) = [Function]
[ ] normalize (802c3f0) = [Function]
[ ] hasChildNodes (802c428) = [Function]
[ ] insertBefore (802c460) = [Function]
[ ] replaceChild (802c498) = [Function]
[ ] removeChild (802c4d0) = [Function]
[ ] hasAttributes (802c508) = [Function]

#10 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 10:04 PM

Ran CCleaner - nifty program! Restarted FF... within 1minute it was at 1.2GB and then crashed.

Some add-on is messing with it - I don't know how Avast! caused this, but then again, I don't know why I had to reinstall my graphics drivers either. I am going to start disabling add-ons one at a time.

I also tried the things on this page:

http://userscripts.org/topics/24842?page=2

#11 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 10:23 PM

Ok, I have disabled all the add ons except for Mozilla's leak detector - and I keep getting javascript leaks all over the place until FF crashes. Its all Javascript from what I can tell.

#12 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 10:42 PM

Yup, its javascript. If I disable it in FF then its stable and runs fine. If I enable it, it leaks memory until it crashes around 1.5gb.

I know there are many reasons not to run js anyway, but I would still like to be able to do so if I had to. Perhaps I will just leave it off until the next update of FF, maybe that will fix it? I don't know. And again, I have no idea how Avast was able to do this, its very strange to me.

#13 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 07 December 2009 - 11:07 PM

IE isn't doing the same thing but I have found that when I open IE, 2 instances of it appear in the Task Manager - I don't remember this happening before.



Just an update so everyone knows, apparently this is new in IE8. It splits up multiple tabs into multiple instances so that if one tab crashes it doesn't kill the whole thing. It isn't exactly one tab per instance - MS says that there is a dynamic 'balancing act' so that with, for example, 60 tabs open there may be 20 instances, each hosting a few tabs.

Just thought the info I learned may be helpful to others.

#14 intron

intron
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:02:32 PM

Posted 08 December 2009 - 12:04 AM

Ok, it seems to be doing it even with JS disabled now. I have no idea what is going on. I installed the latest beta version of FF - no change. Have uninstalled and reinstalled - no change.

After getting rid of Avast and Online Armor and reinstalling graphics driver the computer, overall, seems about back to normal. IE is about its normal self. Opera is zooming right along. But FF is still dead in the water. I thought it was Javascript but its just memory leaks in general and I have no idea what to do.

#15 bluesjunior

bluesjunior

  • Members
  • 761 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:32 PM

Posted 08 December 2009 - 08:25 AM

You can import all your favorites etc from Firefox into IE8. I suggest you do this then go to File Hippo http://www.filehippo.com/ and download to your desktop new copies of Firefox 3.5.5, not the 3.6 Beta you have just installed, Java 6 Update 17, and Revo uninstaller if you do not already have Revo. Firstly install Revo and then using it uninstall both Firefox and the version of Java which is on your PC at present. Reboot after this and do a search on your PC including hidden locations for any remnants of either the old Firefox or the old Java installs. Delete anything found and then reinstall both Firefox and Java from your desktop. Once you are back in Firefox you can then import your favorites back from IE8.
Motherboard: Gigabyte GA-MA770T-UD3, CPU: AMD Athlon II X3 450 Processor, Memory: OCZ 4GB (2x2GB) DDR3 1333MHz,Graphics: PowerColor HD 5750 1GB GDDR5,
PSU: Corsair 430W CX PSU 4x SATA 1x PCI-E, Hard Drive:Samsung SpinPoint F3 500GB Hard Drive SATAII 7200rpm 16MB Cache.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users