PDA

View Full Version : Need User Feedback: False positive: Firefox bookmark.htm removal



jdonner
2009-02-06, 19:59
Hello, all--

I don't know if anyone else has encountered this, but friends of mine have been hit twice by a false positive. After doing a S&D scan, the main Firefox "bookmarks.htm" file (where it stores all saved bookmarks) has been targeted as spyware and recommended for removal. I found that in each instance, the file contained an entry for "http://www.spywareinfo.com" (a defunct site about spyware issues). In each case, my friends dutifully clicked "fix selected problems," and S&D deleted their bookmarks file entirely!

In many cases, this can be fixed by restoring from a backup copy of the file. In Windows, at least, there should be backup copies in the user's documents & settings folder, under "application data/mozilla/firefox/profiles/{default profile}/bookmarkbackups" where {default profile} is the name of your profile folder. Copy the newest one to the {default profile} folder and rename it "bookmarks.htm" to restore. If you don't have backups, you may be out of luck, unless you have a file undelete program and catch it in time. A good reason to keep regular backups! There is a great extension called FEBE, which backs up your Firefox profile and can be set to do regular scheduled backups. It's available at the Firefox extensions site.

Just a heads up, in case anyone else has had this happen. Hopefully, this can be rectified by the developers in the next round of updates.

Jay

Yodama
2009-02-09, 07:11
This is not a false positive.
The domain spywareinfo.com has been sold to unknown and now advertises fake security software.

PepiMK
2009-02-09, 09:32
Yodama, I think what jdonner meant was that the full file was deleted...

We'll check this!

PS:
Which version of Spybot-S&D?
Which version of Firefox?

Yodama
2009-02-09, 11:04
well , uh, looks like I got a littel confused this morning :rolleyes:

Additionally it would also be good to know which operating system might be affected.

As of now I checked this with Spybot 1.5.2, 1.6.0 and 1.6.2 on Windows XP with Firefox 2.0.20 , 3.0 and 3.0.6
In none of these pairings the bookmark.htm was removed.
However Spybot 1.6.0 and 1.6.2 detected the bookmark but were not able to remove the bookmark from Firefox 3+