Problem with sudden Firefox slowing

[Asyn]

Great news!  Thank you for letting me know.

And also many thanks for the feedback, guys..!!
asyn

[HPY]

Glad to hear Firefox is working better for you now.  Would you post the Report ID of the most recent crash report?  Get it as follows:
Enter about:crashes in the url bar to get the Submitted Crash Reports page.  Post the Report ID of your most recent crash here.  Don't post the whole report itself, just the ID, which consists of about twenty letters, digits, and dashes.  Thanks.

Alan,

Everything is up and stable - NS too. I think that your suggestion to add that FlashPlayer filter to ABP may have helped stabilise it.
I note that the Flash panel now reads "we noticed that your FP is not up to date - click here to update" etc. As I mentioned, I did so and the "churning" started.
2 points:
1. Why would FlashPlayer introduce an update that had this effect?
2. I am curious to learn how you pinpointed the problem so quickly?

I ask, because it is frustrated incidents like these that have caused me to take drastic measures like messing with the Registry (I think I wrecked my old laptop "doctoring" around with it - trying dodgy anti-spyware and registry fixes.)


However here is that crash report ID  - it may tell you more:
bp-4f9f634d-19a8-4437-8859-8d3e12100619   19.06.2010   14:37   - on the report itself it reads as:
ID: 3ea0cc6b-fbf9-4632-8026-b6d932100615

It tells me nothing of course, but it may tell you something useful.  It mentioned "ns" a few times and "Plug-ins" - which ? FP?

Anyway Firefox started to work normaly immediately after it restarted and before I took your ABP filter advice. So possibly Firefox kicked out whatever was jamming it anyway?

[HPY]

Sorry about the html mix-up in last post addressed to ALAN BAXTER. Here it is again:

Alan,

Everything is up and stable - NS too. I think that your suggestion to add that FlashPlayer filter to ABP may have helped stabilise it.
I note that the Flash panel now reads "we noticed that your FP is not up to date - click here to update" etc. As I mentioned, I did so and the "churning" started.
2 points:
1. Why would FlashPlayer introduce an update that had this effect?
2. I am curious to learn how you pinpointed the problem so quickly?

I ask, because it is frustrateinf incidents like these that have caused me (and probably many other born button-pushers!!) to take drastic measures like messing with the Registry (I think I wrecked my old laptop "doctoring" around with it - trying dodgy anti-spyware and registry fixes.)


However here is that crash report ID  - it may tell you more:
bp-4f9f634d-19a8-4437-8859-8d3e12100619   19.06.2010   14:37   - on the report itself it reads as:
ID: 3ea0cc6b-fbf9-4632-8026-b6d932100615

It tells me nothing of course, but it may tell you something useful.  It mentioned "ns" a few times and "Plug-ins" - which ? FP?

Anyway Firefox started to work normaly immediately after it restarted and before I took your ABP filter advice. So possibly Firefox kicked out whatever was jamming it anyway?

[Alan Baxter]

Looking at http://crash-stats.mozilla.com/report/index/4f9f634d-19a8-4437-8859-8d3e12100619

The crash occurred in TFWAH.dll, a ThreatFire module that is part of ThreatFire's "Active Defense Technology".  From the WinPatrol Plus database:

ThreatFire Service – TFWAH.EXE

Tfwah.dll, tfgui.dll, and tfservice.exe install with ThreatFire from PC Tools. ThreatFire (formerly CyberHawk) and ThreatFire Pro promise to use "Active Defense Technology" to protect you from viruses, Trojans, and other types of malware including those that are not yet known to regular antivirus programs. This is intended as real-time protection so you'll need to leave this tfservice.exe running if you want the protection this program promises. You'll find more information at http://www.threatfire.com/.

# Safe

There may be a bug in the ThreatFire module.  See if there's a more recent version of ThreatFire available.  It may not have that problem. If you get any more Firefox crashes which occur in that module, then I suggest turning off that ThreatFire service.

1. Why would FlashPlayer introduce an update that had this effect?

- Coincidence?
- Problematic interaction between Flash and ThreatFire?
- Bug in new Flash version?
- Something unique to the problematic BUSINESS BULLET's Flash player or content? (This would be my first guess, especially if the problem stays fixed with that custom Adblock Plus filter.  The previous scenarios are possible too but harder to confirm.)

2. I am curious to learn how you pinpointed the problem so quickly?

- In my experience, CPU problems caused by visiting a web page are usually caused by Flash content.
- I typically use NoScript with NoScript Options > Embeddings > Apply these restrictions to whitelisted sites too checked.
- According to NoScript, BUSINESS BULLET is the only Flash object on the web page.
- Allowing the Flash object to run by clicking on its NoScript placeholder caused my CPU to jump to 100% and stay there. (I have a slow computer, so it may not jump that high for other people.)
- The Adblock Plus blockable items pane shows that http://www.telegraph.co.uk/telegraph/template/utils/ooyala/telegraph_player.swf is the only url with type object on that page.  It's the same url that NoScript displayed in the placeholder tooltip before I clicked it.

I ask, because it is frustrateinf incidents like these that have caused me (and probably many other born button-pushers!!) to take drastic measures like messing with the Registry (I think I wrecked my old laptop "doctoring" around with it - trying dodgy anti-spyware and registry fixes.)

I agree.  Nothing like buying software which promises to "boost your speed" by cleaning the registry!  Aack!

However here is that crash report ID  - it may tell you more:
bp-4f9f634d-19a8-4437-8859-8d3e12100619   19.06.2010   14:37   - on the report itself it reads as:
ID: 3ea0cc6b-fbf9-4632-8026-b6d932100615

It tells me nothing of course, but it may tell you something useful.  It mentioned "ns" a few times and "Plug-ins" - which ? FP?

Hard to tell.  I think "ns" stands for Netscape, an ancestor of Firefox.  By the way, since it doesn't matter, the second id is for a crash which occurred four days earlier on 2010-06-15.  It crashed in the ThreatFire module too.

Anyway Firefox started to work normaly immediately after it restarted and before I took your ABP filter advice. So possibly Firefox kicked out whatever was jamming it anyway?

I hope so.  I wouldn't be concerned about that issue anymore unless it recurs.  (But keep that BUSINESS BULLET blocked with Adblock Plus.)

[HPY]

Alan,

Thank you for the informative, interesting reply.

TFWAH.EXE - Threatfire - I have never been aware of it,  it uses very little CPU and updates itself in the background. i have just run its "Smart Update" - no new versions available, but just the usual update.  It has reacted to the same threats as Vista's Windows Defender, usually more quickly.  I consider it a useful back-stop to Avast, but do you think I should do without it?
TF reacted to this Flash update whereas NS, Adblock and Avast did not. Maybe I should ditch TF.

I also have Adblock, NS, WD, Avast 5 and activate SuperAnitiSpyware Free occasionally for a quick scan, which has only ever caught a couple of  harmless cookies. The SAS free version is totally passive and does not run intil you activate it for updates and scans.
Do you think this as well as Threatfire is overkill?

Whenever I install free security software, I always google for what I consiedred to be reliable evaluations -CNET etc.
Threatfire was a recommended addition to Avira Free (which I used before installing  Avast 5.8 updating to 5.) My principle is that no AV etc. is 100% and some are clearly "better" than others (Avast, Avira which also are easier on resouces than clunkers like Norton - although the press seemed to think that Avast now has the edge on Avira - it is certainly more transparent/user friendly /tells you more about your computer), therefore I thought it best to cover as many angles as possible without overkill.

Meanwhile I will keep that BUSINESS BULLET blocked with AP.

[Alan Baxter]

Thank you for the informative, interesting reply.

You're very welcome.  It's obviously my pleasure to dig through these little puzzles when I can.  Usually one of the regulars has the time and does a better job than I can on stuff that doesn't involve Firefox.

TFWAH.EXE - Threatfire - I have never been aware of it,  it uses very little CPU and updates itself in the background. i have just run its "Smart Update" - no new versions available, but just the usual update.  It has reacted to the same threats as Vista's Windows Defender, usually more quickly.  I consider it a useful back-stop to Avast, but do you think I should do without it?
TF reacted to this Flash update whereas NS, Adblock and Avast did not. Maybe I should ditch TF.

I wouldn't consider dropping ThreatFire unless you have a crash again and the crash report lists TFWAH.dll.  I don't recall hearing that ThreatFire is generally problematic or ill-advised.  I don't use happen to use it.  Avast 5 plus WinPatrol is enough for me.

I also have Adblock, NS, WD, Avast 5 and activate SuperAnitiSpyware Free occasionally for a quick scan, which has only ever caught a couple of  harmless cookies. The SAS free version is totally passive and does not run intil you activate it for updates and scans.
Do you think this as well as Threatfire is overkill?

Whenever I install free security software, I always google for what I consiedred to be reliable evaluations -CNET etc.
Threatfire was a recommended addition to Avira Free (which I used before installing  Avast 5.8 updating to 5.) My principle is that no AV etc. is 100% and some are clearly "better" than others (Avast, Avira which also are easier on resouces than clunkers like Norton - although the press seemed to think that Avast now has the edge on Avira - it is certainly more transparent/user friendly /tells you more about your computer), therefore I thought it best to cover as many angles as possible without overkill.

It sounds like you've done your homework.  Good for you!  No security software is 100% and just adding more to the mix doesn't make things much safer.  IMHO, they can make browsing less safe if you rely on them due to a false sense of security.  Safe browsing habits are much, much more important.  Does WD stand for Windows Defender?  For me, I think Avast + WinPatrol is plenty.  The NoScript extension does a great job at protecting us from hacked or malicious web site attacks, especially the zero-day attacks that signature-based security software can't detect.

[HPY]

Alan


WD meant  Windows Defender which comes preinstalled with Vista.
But I do wonder whether all this stuff (e.g.TF and Supar AntiSpyware)  on top of NS and Adblock - both of which are recommended by Firefox, as my surfing is not reckless - but you never know!

You are obvioulsy more informed than I am - so if Avast and Winpatrol are enough for you, maybe I should trim off SAS and TF, substituting the latter with WinPatrol, which I am about to investigate in case of another TFWAH.dll . It uses the same principle as TF - heuristic and has a similarly small footprint - I would be thinking of the free version after deinstalling SAS and TF.

But thanks once again - I was stumped, but thanks to this forum  have outgrown the habit of using the "fun cleanup" remedies!

[Alan Baxter]

if Avast and Winpatrol are enough for you, maybe I should trim off SAS and TF, substituting the latter with WinPatrol, which I am about to investigate in case of another TFWAH.dll . It uses the same principle as TF - heuristic and has a similarly small footprint - I would be thinking of the free version after deinstalling SAS and TF.

Yeah, don't pay for WinPatrol until you've used it for awhile and find it personally valuable.  Since SAS is non-resident, there's no need to uninstall it.  It doesn't hurt to run it occasionally to see what it finds.  If SAS or Avast ever finds anything serious that isn't a false positive, see if you can figure out where it came from and perhaps modify your browsing/downloading habits accordingly.  I figure that if Avast ever legitimately flags something I downloaded as malware, then I shouldn't have downloaded it in the first place and was just lucky it was detected.

[Lisandro]

It doesn't hurt to run it occasionally to see what it finds.

It loads drivers at boot time and, if I'm not wrong, services also.
Too much for an on-demand scanner only.
Nothing against SAS, just my personal opinion (as always .

[Saty]

Tech,

your right, yes it does, but its usage is next to nill while its sitting there, a user can always disable the startup if its that aggrevating. I have one laptop with it disabled on startup, and the other its not. The one its not lets me start it  with less clicks and waiting.

 I wouldnt NOT use it just because of this issue.

Sat

[Alan Baxter]

Thank you for chiming in, Tech.  I'm pretty sure SAS free wasn't running any services or start-up programs for me.  I may have disabled them with Autoruns or WinPatrol.  I don't have SAS installed now so I'm going on memory.  (When Secunia PSI notified me a while ago that SAS had a security update available, I uninstalled it instead of updating because I realized I didn't use it anymore.  I can always reinstall it later if desired.)

[Asyn]

It loads drivers at boot time and, if I'm not wrong, services also.
Too much for an on-demand scanner only.
Nothing against SAS, just my personal opinion (as always .

And it doesn't find that much anyway...
asyn

[Lisandro]

I may have disabled them with Autoruns or WinPatrol.

Yeah, Autoruns could disable the drivers loading...
I've stop using also due to save time on updatings... The update is the full database (not incremental) and I was using too much things on demand. My strategy now is: only avast (I've disabled ThreatFire and Winpatrol), full partitions backups, Comodo Time Machine (beta).

And it doesn't find that much anyway...

+1 Only cookies...

[Saty]

And it doesn't find that much anyway...

+1 Only cookies...
[/quote]

going off topic......

Hmm, I didnt know that, thank you both for the heads up, I will no longer recommend SAS to anyone here again........I guess I should dump it, and malwarebytes as well, as it doenst find much anyways either using your logic. Its found 1 thing on my system in 1.5 years, so wasted space.

 I wont used Asquared, it always finds lots of stuff, but the wrong stuff. I guess on damand scanning isnt needed at all.

again, thank you both for the correction on my thinking, I appreciate it, Ive learned something new today.

i appologize for going offtopic
Sat

[Alan Baxter]

SAS and MalwareBytes may not be very useful on clean systems like ours, Sat, but, along with Avast 5, their on-demand scanners can be very useful for evaluating an unknown system or a system that seems to be misbehaving.