You are here

Thunderbird unexpected DLLs message

6 posts / 0 new
Last post
gmacm
Offline
Last seen: 7 years 8 months ago
Joined: 2009-01-09 03:23
Thunderbird unexpected DLLs message

One or more unexpected DLL files were found in the same directory as K:\PortableApps\ThunderbirdPortable\ThunderbirdPortable.exe. This could be an indication of a covert attempt to hijack the application using DLL injection. Please check the application before using it.
I have Kaspersky and Malware scanned the directory with a negative result.
What do I do next since I cannot load Thunderrbird.

John T. Haller
John T. Haller's picture
Offline
Last seen: 3 hours 31 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
What DLLs are there?

Open up K:\PortableApps\ThunderbirdPortable in Windows Explorer and tell us what DLLs you see there. There shouldn't be any.

For full background on the possible hijack issue and the Platform's scanning and mitigation of it, see here: https://portableapps.com/news/2017-03-13--mitigating-dll-hijacks-with-th...

Note that ThunderbirdPortable.exe is not vulnerable to any known DLL hijack issues. The alert shows despite that because in some apps the working directory of the launcher is scanned by some vulnerable parts of the app itself and it can be hijacked that way.

Sometimes, the impossible can become possible, if you're awesome!

gmacm
Offline
Last seen: 7 years 8 months ago
Joined: 2009-01-09 03:23
Thunderbird unexpected DLLs message

John
Many thanks for your comments. I have opened the directory and there were 31dll's sitting there.
I have listed them below.

AccessibleMarshal
Breakpadinjector
D3DCompiler_43
freebl3
gkmedias
libEGL
libGLESv2
MapiProxy
MapiProxy_InUse
Mozalloc
Mozglue
Mozjs
mozMapi32
mozMapi32_InUse
mozsqlite3
msvcp100
msvcr100
nsldap32v60
nsldappr32v60
nsldif32v60
nspr4
nss3
nssckbi
nssdbm3
nssutil3
plc4
plds4
smime3
softokn3
ssl3
xul

I would be grateful for any comments/help you may be able to offer.

Best regards

Graeme.

graymac

Gord Caswell
Gord Caswell's picture
Offline
Last seen: 1 day 10 hours ago
DeveloperModerator
Joined: 2008-07-24 18:46
X:\PortableApps\ThunderbirdPortable

It appears you've gone deeper than requested.

Note that John asked for any DLLs in X:\PortableApps\ThunderbirdPortable, not X:\PortableApps\ThunderbirdPortable\App\Thunderbird or elsewhere within the application structure.

gmacm
Offline
Last seen: 7 years 8 months ago
Joined: 2009-01-09 03:23
X:\PortableApps\ThunderbirdPortable

Hi Gord

The list of 31 DLL's are those in the X:\PortableApps\ThunderbirdPortable directory. In the X:\PortableApps\ThunderbirdPortable\App\Thunderbird directory I have 26 DLL's which are mainly the same as the 31 listing but some are not in the "31" group.
I have moved all of the "31" group to a blind directory and Thunderbird now loads with no queries but I would still like to know how they landed in this place.

Regards

Graeme

graymac

Gord Caswell
Gord Caswell's picture
Offline
Last seen: 1 day 10 hours ago
DeveloperModerator
Joined: 2008-07-24 18:46
Clean install

In that case, I advise doing a clean install of Thunderbird, saving your X:\PortableApps\ThunderbirdPortable\Data directory prior to doing so, and copying it into the clean copy once installed.

Log in or register to post comments