persistent new unprotected cookies ('Ad*') in Firefox browser

Discussion in 'SpywareBlaster & Other Forum' started by Frankenstien, Jun 10, 2020.

  1. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    Not sure what to make of this (Subject) so joined up here and will describe issue.

    On a fresh install of Win 7 Pro SP1 64-bit, I've ad-lib-installed latest free versions of s/w I am already familiar with, including SpywareBlaster, Spybot S&D, Malwarebytes, ZA Free Antivirus + Firewall, Firefox, Chrome & IE.

    I typically only browse with Firefox and have had to progressively tighten up Privacy (cookie) settings from memory.

    As a result, I think I've taken on a persistent 3rd party cookie ... prior to clamping down on 'Block'ing 'All third-party cookies' in Firefox ...

    This persistent cookie's source eludes me ... SpywareBlaster finds one to three, four or five instances of new unprotected cookies in Firefox almost every time I launch it ... whose SpywareBlaster designations / names were initially '247Media', '123Counts', '2o7.net', '7AdPower', '7Search', and now all seem to start with 'Ad ... ', i.e. 'AdBureau', 'AdButler.de', 'AdFlow', 'AdInterax', 'AdJuggler', 'AdLegend', 'Ad-Logics', 'AdMinder', ect. ... I've grown weary of cataloguing every new cookie instance and am now just enabling protection for all new cookies found by SpywareBlaster in Firefox upon each launch of SpywareBlaster.

    The trouble is, although I've gone to the Firefox repository for profiles and cookies (in %APPDATA%\Mozilla\Firefox\Profiles\(profile name)\cookies.sqlite), I cannot find evidence of any of these cookies using the SpywareBlaster designations / names (i.e. opening the .sqlite file with Notepad and searching).

    Spybot S&D, Malwarebytes and ZA Free Antivirus + Firewall have been updated on multiple occasions and scans run repeatedly ... they do not find any issues, certainly none that relate directly to what SpywareBlaster is finding ... repeatedly.

    I do not see how to extract detailed info about these cookies (i.e. where, and, within what file they reside) from SpywareBlaster directly ... that capability would go a long way in identifying and erradicating this / these cookies.

    Thanks, FFF
     
    Last edited: Jun 10, 2020
  2. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    SpywareBlaster does not "find" anything. It offers passive protection only, and in the case of Firefox, it just populates the block cookies list. Have you enabled all protection in SpywareBlaster?
     
  3. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    Hey Krusty ... thanks for weighing in ... OK ... and ... yes to enabling all protection ... repeatedly ... what's weird is I've never seen persistent issues in SpywareBlaster like this before ... and have used it on lots of other systems / OS' ...

    I'm seemingly unable to correlate what SpywareBlaster is populating in the block cookies list with the list of sites within Firefox at 'Privacy & Security' > 'Cookies and Site Data' > 'Manage Data' ...
     
  4. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    I just checked Firefox 77.0.1 and I can't locate the blocked list anymore. I couldn't say how long it has been like that because it is usually set and forget. In any case, SpywareBlaster is showing all protection is enabled on this machine.

    We may have to wait for @javacool to check why the blocked cookies list is no longer showing in FF. Maybe an update is required.

    As for your problem... yeah, dunno.
     

    Attached Files:

  5. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    ... but you can see the 'Manage Data' list (at the Options path I mentioned above in post #3) though - right?
     
  6. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    Yeah, I meant the blocked cookie list isn't populated by SB now.
     
  7. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    ... bump ...
     
  8. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,881
    Location:
    Slovenia, EU
    Did you consider that there might be a problem with SpywareBlaster? If you check your original post you can see that names you mentioned are sorted alphabetically (first numbers then letters) and it seems like every time it shows new ones that are by name alphabetically after previous ones. That's statistically speaking close to impossible. If I had to bet I would say that there is something wrong with those detections.

    EDIT: sorry just saw it's not about detections. Still strange that unprotected cookies are shown that way (alphabetically sorted).
     
    Last edited: Jun 12, 2020
  9. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    Minimalist ... thanks for weighing in ... presumably my SpywareBlaster installation is a good, clean install and is doing its' job properly (it behaves normally in every other respect) ... if there was a way to correlate the new, unprotected cookies it keeps seeing with the 'Manage Data' list in Firefox of sites that are storing cookies (and other site data / cache), then I could selectively remove the offending site(s) ... some site must have saved a cookie or cookies (prior to me blocking all 3rd party cookies in Firefox) that is / are managing to stay alive by morphing their name designations (at least as far as SpywareBlaster is concerned, it seems) ... I could 'Clear Data' or 'Remove All' (to see if the Subject behaviour persists - it just might, which would be indicative of a far larger problem), however, I'd prefer to identify the offending site(s) and see who they are / what they're up to exactly ... FYI - my 'Manage Permissions' / 'Exceptions - ... ' list is empty ... there used to be one site there that was 'Allowed' (I did not capture the site name, nor do I recall it now), however, I removed it several days ago ...
     
  10. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    I wonder if there isn't a conflict with Spybot S&D.
     
  11. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    ... weird ... when I checked my thread here just now, this forum advised me that my e-mail address wasn't accepting e-mails from here anymore ... so ... switched my registered e-mail here to an alternate ... am once again actively receiving e-mail advice from this forum ...

    So, Krusty ... what makes you wonder about Spybot S&D?

    FFF
     
  12. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    It's been a looonnnnng time since I've had anything to do with Spybot but doesn't it also populate the blocked cookies list of browsers?

    Anyway, my guess about SpyBot was because not many use it here anymore. I don't and don't have your problem.
     
  13. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    Fair enough ... this is what Spybot S&D v2.8 shows for 3rd party cookies:
    upload_2020-6-14_17-29-58.png
    However, I really don't think there's any connection as you suggest Krusty ... what I believe I really need is assistance from someone in the know re: identifying the source file(s) that SpywareBlaster is reading the protected and unprotected cookie designations / names from ... FFF
    1745PDT edit: one thing I will say, every new unprotected cookie that crops up has been alphabetically incremental ... as Minimalist had pointed out earlier as being statistically impossible ...
    2056PDT edit: latest unprotected cookie detection broke the alphabetical trend ...
     

    Attached Files:

    Last edited: Jun 14, 2020
  14. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    4,098
    There appears to be a bug in the latest version of Firefox. We're investigating to try to determine whether it's just a UI bug, or it impacts behavior, but regardless - it seems fairly easy to get Firefox into a weird state where using its own UI to edit the Cookie Permissions doesn't load any changes you make after a restart of the browser.

    Whether the Firefox bug is the only issue impacting what you're seeing, or whether there's also a conflict with another tool (like Spybot) incorrectly messing with the same files (or trying to "clean" profile data), is something that remains to be seen.

    So we'll do some more digging on this. If it's something we can work around in SB we'll of course do that, if not we'll reach out to Firefox with a bug report and a proposed patch.
     
    Last edited: Jun 17, 2020
  15. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    Thanks javacool for weighing in on this, for the info you have provided and letting me know. I'll just wait for developments. FFF
     
  16. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    ... bump ... javacool ... just to let you and everyone else here know I'm still seeing the problematic repetitive unprotected new cookies (for Firefox Browser 77.0.1 [64-bit]) behaviour in SpywareBlaster v5.6 (which itself took a database update a couple of days ago [29JUN20]) ... FFF
     
  17. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    ... my issue may have had to do with https//:cj.com ... Commission Junction ...
    ... upon updating Firefox Browser to 78.0.1 (64-bit) today, then checking the 'Manage Permissions' / 'Exceptions - ... ' list, that site popped up in the previously empty list (Firefox 'Options' path: 'Privacy & Security' > 'Cookies and Site Data') ... I 'Remove'd it ...
    ... this also marked the last? occurrance of an unprotected cookie (named 'Commision Junction (5)') in SpywareBlaster ... I 'Protect ... 'ed it and have not had any more unprotected cookie occurrences today ...
    ... continuing to monitor ...
     
  18. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    ... nope ... new unprotected cookie occurrences in SpywareBlaster still happening ...
     
  19. AkaArturo

    AkaArturo Registered Member

    Joined:
    Jul 16, 2020
    Posts:
    2
    Location:
    USA
    For what it's worth, I have this identical problem; I run SpywareBlaster and do not run Spybot S&D. Malwarebytes finds nothing wrong. I don't recall ever having visited cj.com. My unenabled cookie has now reached into the L's. My current test is to disable all automatic CCleaner Pro runs. I saw years-old posts about this problem that attributed it to FF Site Preferences, but I don't have those checked in FF or CCleaner.
     
  20. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    ... interesting ... thanks for steppin' up and chiming in AkaArturo ... I'm still seeing this behaviour ... my SpywareBlaster unprotected cookie occurrences are only in to the 'F's ... FFF
    P.S.
    not quite sure I understand your 'current test' methodology by disabling all automatic CCleaner Pro runs ... I don't use that utility ... does that mitigate the behaviour we're seeing? Or ?
     
  21. AkaArturo

    AkaArturo Registered Member

    Joined:
    Jul 16, 2020
    Posts:
    2
    Location:
    USA
    Uh oh. I thought that CCleaner was causing this problem. If you are not using it, then I suspect it is SpywareBlaster or Firefox causing it. And, indeed, I just checked SB and I have a "partially enabled" status for FF. It's odd that it takes several hours before that happens. As an old-time Computer Science prof, this sure looks like a boundary/range error to me. Since SB is passive until launched, either SB is not the cause or just launching it a some number of times is the cause. More likely to be FF or something else that we cannot see.
     
  22. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
  23. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    4,098
    There may be several potential causes here. There have been issues with certain versions of "cleaning" tools like CCleaner incorrectly removing SpywareBlaster protection entries in the past, and there are the aforementioned issues in Firefox itself.

    We're continuing to investigate the best way to resolve this for the users who are impacted.
     
  24. Frankenstien

    Frankenstien Registered Member

    Joined:
    Jun 10, 2020
    Posts:
    19
    Location:
    Vancouver, B.C., Canada
    FYI all, javacool ... described issue (first post, this thread) persists in SpywareBlaster 6.0 (in conjunction with Firefox Browser 79.0 (64-bit)) ... FFF
     
  25. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    4,098
    Please try opening SpywareBlaster, disabling all protection, and then re-enabling all protection.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.