MBAM 3.3.1 and Firefox 57.0.2 craziness

[CDay]

Hi all,

This issue has been making my head spin for over a month, and I'd like to share the joy.

After Firefox 56.0.2 upgraded itself to 57, in several Windows 7 64-bit virtual machines as well as 1 physical machine, (all are fully updated, activated and genuine,) Firefox crashes immediately on startup with:

Problem signature:
  Problem Event Name:    APPCRASH
  Application Name:    firefox.exe
  Application Version:    57.0.2.6549
  Application Timestamp:    5a2846ff
  Fault Module Name:    StackHash_cbb0
  Fault Module Version:    0.0.0.0
  Fault Module Timestamp:    00000000
  Exception Code:    c0000005
  Exception Offset:    000000006fff0d2a
  OS Version:    6.1.7601.2.1.0.256.48
  Locale ID:    1033
  Additional Information 1:    cbb0
  Additional Information 2:    cbb0a0f748726801023e51fb7e1bdee0
  Additional Information 3:    0f94
  Additional Information 4:    0f9406f691682c10e90b6948a11b9541

There is no way to start the Profile Manager, or start in Safe Mode.  Renaming the default profile to *.bak doesn't help.  MS Security Essentials finds no infections, and restarting Windows with all non-MS services disabled doesn't do the trick either.  The Firefox support forum has not yet identified an underlying issue. 

At my wits end, I installed MBAM 3.3.1, ran a scan and quarantined 1 identified threat called PUP.Optional.Amonetize.  Oddly enough, this threat wasn't found in another affected VM.

Afterward, Firefox 57 started working!!!

I thought the issue was resolved, and to test this hypothesis I uninstalled MBAM, only to have the crashing Firefox issue return.

What I now know is there is a definite correlation between Firefox working while MBAM Exploit Protection is ON, versus Firefox crashing with Exploit Protection OFF. 

This behavior is completely reproducible, and I humbly beg for assistance in understanding what is going on here.

__
Chris

mb-check-results.zip

Edited December 13, 2017 by CDay
Verbiage.

[dcollins]

You're saying that Firefox will crash, even if Malwarebytes is not installed?

1 hour ago, CDay said:

I thought the issue was resolved, and to test this hypothesis I uninstalled MBAM, only to have the crashing Firefox issue return.

 

[CDay]

58 minutes ago, dcollins said:

You're saying that Firefox will crash, even if Malwarebytes is not installed?

 

Correct.  

MB installed with Exploit Protection on appears to be the only reason Firefox is not crashing.

Evidenced by going into EP --> Manage Protected Apps, and specifically turning EP off or on for Firefox.

Something I forgot to mention -- after Firefox started working I started it with -profilemanager, created a new, empty profile, but this had no effect, Firefox would still crash without MB installed and EP on.

Edited December 13, 2017 by CDay
More details.

[dcollins]

How are you uninstalling Malwarebytes and turning on Exploit Protection? 

[rcmck]

I was just trying to help a person complaining that firefox stopped loading, I was doing the usual things, adw cleaner, then installing mbam, in the middle of the mbam scan, I tried to open firefox, it loaded, I assumed it was already fixed by adw, I finished the scan and cleanup, then I disabled premium, just before calling it good I decided to open firefox again to make sure everything was good, and it doesn't load anymore. I found this forum post after googling for a solution, so I guess I can confirm this craziness. 

[CDay]

4 hours ago, dcollins said:

How are you uninstalling Malwarebytes and turning on Exploit Protection? 

Please excuse if any of my explanations have been unclear -- technical clarity is a priority in my day to day.

Firefox only starts when MB is installed and EP is on -- but if I turn EP off, Firefox starts crashing again.

Uninstalling MB was just a test to see whether or not removal of PUP.Optional.Amonetize fixed things with Firefox, which it did not.

The most surprising aspect of this saga was reinstalling MB and finding that Firefox started working again.

I then narrowed it to Exploit Protection being on or off, just prior to my OP.

[dcollins]

Sorry, I'm still not understanding. Let me try to clarify:

No Malwarebytes: Firefox crashes

Install Malwarebytes, turn on Exploit Protection: Firefox runs properly

Install Malwarebytes, turn off Exploit Protection: Firefox crashes

[CDay]

1 hour ago, dcollins said:

Sorry, I'm still not understanding. Let me try to clarify:

No Malwarebytes: Firefox crashes

Install Malwarebytes, turn on Exploit Protection: Firefox runs properly

Install Malwarebytes, turn off Exploit Protection: Firefox crashes

That summary is correct.

[dcollins]

Thanks. This sounds like the issue is with something else on your  computer then, and not Malwarebytes. Have you tried removing Firefox and reinstalling it?

[CDay]

22 minutes ago, dcollins said:

Thanks. This sounds like the issue is with something else on your  computer then, and not Malwarebytes. Have you tried removing Firefox and reinstalling it?

Yes.   Reinstalling Firefox has no effect, nor am I able to revert to 56.0.2.

I agree that the problem appears local, but what's most perplexing is that it's affecting virtual and a completely unrelated physical machine, and is somehow fixed with MB Exploit Protection, which led me here.

Thanks for your time, dcollins. 

 

[CDay]

@rcmck -- The Firefox developers seem to be aware of the issue, at least here.

The given workaround (run 32-bit, not 64) does indeed work without MB installed.

[rcmck]

Thanks, I will try 32 bit, this is still very strange, the fact that this is happening to you with a virtual machine, I was thinking maybe we had similar hardware that it was related to, I am lucky google indexes so quickly or I would not have found this thread, and still be scratching my head.