Results 1 to 4 of 4

Thread: False positive: Firefox bookmark.htm removal

  1. #1
    Junior Member
    Join Date
    Feb 2009
    Posts
    1

    Exclamation False positive: Firefox bookmark.htm removal

    Hello, all--

    I don't know if anyone else has encountered this, but friends of mine have been hit twice by a false positive. After doing a S&D scan, the main Firefox "bookmarks.htm" file (where it stores all saved bookmarks) has been targeted as spyware and recommended for removal. I found that in each instance, the file contained an entry for "http://www.spywareinfo.com" (a defunct site about spyware issues). In each case, my friends dutifully clicked "fix selected problems," and S&D deleted their bookmarks file entirely!

    In many cases, this can be fixed by restoring from a backup copy of the file. In Windows, at least, there should be backup copies in the user's documents & settings folder, under "application data/mozilla/firefox/profiles/{default profile}/bookmarkbackups" where {default profile} is the name of your profile folder. Copy the newest one to the {default profile} folder and rename it "bookmarks.htm" to restore. If you don't have backups, you may be out of luck, unless you have a file undelete program and catch it in time. A good reason to keep regular backups! There is a great extension called FEBE, which backs up your Firefox profile and can be set to do regular scheduled backups. It's available at the Firefox extensions site.

    Just a heads up, in case anyone else has had this happen. Hopefully, this can be rectified by the developers in the next round of updates.

    Jay

  2. #2
    Senior Member Yodama's Avatar
    Join Date
    Oct 2005
    Location
    Buchenheim
    Posts
    1,110

    Default

    This is not a false positive.
    The domain spywareinfo.com has been sold to unknown and now advertises fake security software.
    born in the shadow to die in the shadow, that is the fate of the shinobi

    Spybot S&D Downloads

    Please help us improve Spybot and download our distributed testing client.

  3. #3
    Member of Team Spybot PepiMK's Avatar
    Join Date
    Oct 2005
    Location
    Planet Earth
    Posts
    3,601

    Default

    Yodama, I think what jdonner meant was that the full file was deleted...

    We'll check this!

    PS:
    Which version of Spybot-S&D?
    Which version of Firefox?
    Last edited by PepiMK; 2009-02-09 at 10:10.
    Just remember, love is life, and hate is living death.
    Treat your life for what it's worth, and live for every breath
    (Black Sabbath: A National Acrobat)

  4. #4
    Senior Member Yodama's Avatar
    Join Date
    Oct 2005
    Location
    Buchenheim
    Posts
    1,110

    Default

    well , uh, looks like I got a littel confused this morning

    Additionally it would also be good to know which operating system might be affected.

    As of now I checked this with Spybot 1.5.2, 1.6.0 and 1.6.2 on Windows XP with Firefox 2.0.20 , 3.0 and 3.0.6
    In none of these pairings the bookmark.htm was removed.
    However Spybot 1.6.0 and 1.6.2 detected the bookmark but were not able to remove the bookmark from Firefox 3+
    born in the shadow to die in the shadow, that is the fate of the shinobi

    Spybot S&D Downloads

    Please help us improve Spybot and download our distributed testing client.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •