"Couldn't load XPCOM" - Browser is completely bricked. Topic is solved

[Daikun]

Operating system: Windows 11
Browser version: 34.2.2
32-bit or 64-bit browser?: 64-bit

When I try to open the PM browser, I get an error message saying "Couldn't load XPCOM." All I can do is click OK and...nothing happens.
I tried closing the browser in the Task Manager, no luck. I tried rebooting my PC, no luck. PM is completely unusable for me.
I had to open another browser just to post this thread in these forums.

[DarthVitrial]

Just happened to me, it's because windows defender is detecting mozjs.dll as Trojan:Win32/Posilod.EB!cl and deleting it. I presume it's a false positive.

[gorodn]

Hurro - Been hammering this for the last 3 hours.

Windows 10 22H2 Build 19045.6332, x64, Windows Firewall, Malwarebytes WFC 6.19.0.0, Alder Lake Core i5 12600K.

Every time I install 34.2.2 something changes the firewall from enabled to DISabled.

I don't have the skills to work through the Event Viewer.

[theAxe1832]

Also having Defendier flag Program Files\Pale Moon\mozjs.dll as Trojan:Win32/Posilod.EB!cl and quarantining it. Submitted to Defender Security Intelligence for a potential false flag.

[Daikun]

I uninstalled and reinstalled the browser and everything was working again...for a couple hours anyway.
Then the problem started again and now I'm back to Brave until this issue is resolved. I don't feel playing this game of "flip the switch" repeatedly.

[Moonchild]

Just happened to me, it's because windows defender is detecting mozjs.dll as Trojan:Win32/Posilod.EB!cl and deleting it. I presume it's a false positive.

Seems to be OK in VT.
64-bit: https://www.virustotal.com/gui/file/8a1 ... 2e0c37172b
32-bit: https://www.virustotal.com/gui/file/0e9 ... 676639693b

So either it was an anomaly for some people, or it's been solved in the meantime.

[thosrtanner]

it just triggered for me as well.

[Moonchild]

Please just restore what was quarantined and report it to Microsoft.

EDIT: To be sure I just did a custom scan after grabbing the latest "security intelligence update" from Windows Update and all the binaries of Pale Moon 34.2.2 pass without issues, so I can only assume it has been addressed on Microsoft's side?

[Potkeny]

I just got the same error when I opened PM through Epyrus, clicking an rss-link. Maybe the "open via default browser" just gives enough extra score to trigger warning?

(34.2.2 64bit, win11)

[Piotrtrkostrzewski94]

I have the same problem. I submitted the post for approval before I saw this one. So, should I restore the file?

[back2themoon]

Friendly advice: avoid using Microsoft's god-awful Defender Antivirus. It's free and all but you get what you pay for in this case. Find an affordable, proper solution. There are still a few good ones out there.

On the other hand, the Windows Firewall is excellent but if you need to harden and configure it, the free and quite amazing Windows Firewall Control is essential.

[Piotrtrkostrzewski94]

Friendly advice: avoid using Microsoft's god-awful Defender Antivirus. It's free and all but you get what you pay for in this case. Find an affordable, proper solution. There are still a few good ones out there.

On the other hand, the Windows Firewall is excellent but if you need to harden and configure it, the free and quite amazing Windows Firewall Control is essential.

Which one do you recommend? I used 360 Total Security on my previous computer, but I think it's time for a change. It can be paid, but it's best to pay annually rather than monthly.

[back2themoon]

Which one do you recommend?

It's been some time since I last researched this area, but happily using ESET at the moment. It's fully configurable (not unlike Pale Moon itself), you can easily disable the more invasive stuff (e.g. SSL/TLS filtering) and its Web Protection does protect Pale Moon (no need for browser-specific extensions).

I've disabled its own Firewall (they do have a firewall-less version as well) because the WF/WFC combination (see above) is preferred for me. You can find good, working deals on eBay etc. if carefully searched. The official website tends to be pricier.

Note they recently introduced a few features that are only meant for "supported browsers" (guess who's not on that list) but it's mostly useless, attention-grabbing PR stuff like "browser screen protection". Every single module can be enabled/disabled/configured and I like that a lot.

[Piotrtrkostrzewski94]

It's been some time since I last researched this area, but happily using ESET at the moment.

I've disabled its own Firewall (they do have a firewall-less version as well) because the WF/WFC combination (see above) is preferred for me. You can find good, working deals on eBay etc. if carefully searched. The official website tends to be pricier.

Note they recently introduced a few features that are only meant for "supported browsers" (guess who's not on that list) but it's mostly useless, attention-grabbing PR stuff like "browser screen protection". Every single module can be enabled/disabled/configured and I like that a lot.

Thank you very much, plus it supports Pale Moon.

I initially select ESET HOME Security Essential.

Note they recently introduced a few features that are only meant for "supported browsers" (guess who's not on that list) - And that doesn't surprise me. But Pale Moon develops faster or slower.

[wavymoon]

I saw this too FYI 😕

[moonbob69]

The suggestion "go into defender, "restore" the file, and report it to Microsoft" is not a permanent solution.

Since the new version came out, the virus warning happened on the first restart since then. I thought it was a bad update file (altered by an unsafe open wifi?), and so deleted Palemoon, then reloaded from the official website. Windows Security shows a "quarantined" then a "blocked" then a "quarantined" again. Using "restore" allows PM to start, but Windows Security still says "This program is dangerous and executes commands from an attacker." We don't have a Microsoft account and so can't "report it to Microsoft".

If in fact the version of mozjs.dll that people have (did someone figure out how to substitute that file in transit and still pass the download check?) does not have any bad code, why not make some minor change to it so that it doesn't trigger any warning, since otherwise you are out of business until Microsoft does something. You might mention this on your home download page since the usual emergency update feature won't work anymore.

[athenian200]

The suggestion "go into defender, "restore" the file, and report it to Microsoft" is not a permanent solution.

If you want a more permanent solution, you can exclude the entire Pale Moon folder from Windows Defender detection.

Also, you can try installing Pale Moon from the Windows Store and see if that makes a difference.

"Changing the file a little bit" wouldn't help anything, in fact the false positive is likely because the file isn't an exact match to previous versions.

Note that the signature:

Trojan:Win32/Posilod.EB!cl

Clearly indicates that cloud-based heuristics were used to flag a suspicious file rather than a definite detection of a virus or malware. It's approaching the point where files have to be on a whitelist and recognized by the system to not get flagged, honestly.

[Moonchild]

If in fact the version of mozjs.dll that people have (did someone figure out how to substitute that file in transit and still pass the download check?) does not have any bad code, why not make some minor change to it so that it doesn't trigger any warning, since otherwise you are out of business until Microsoft does something.

It's not that simple. The match is against a compiled binary -- we don't know what detection was used for it, and even if we did, we can't control what assembled machine code the compiler spits out, precisely, or how to manipulate it into avoiding certain markers.

I'm also unhappy that Microsoft is apparently ignoring the fact it is digitally code-signed (through their own Azure infra, to boot!) for which they are actually getting my money (and signing has been primarily to avoid being constantly flagged by their SmartScreen...).

Also, we aren't "out of business until Microsoft does something", since you can just make an exception as a user. Defender gives notifications so people can immediately see it was Defender doing something wrong and allowing them to take action -- so it's not like the topic title here says that it just "bricks" after update and there are no pointers why.

[back2themoon]

The suggestion "go into defender, "restore" the file, and report it to Microsoft" is not a permanent solution...
Windows Security shows a "quarantined" then a "blocked" then a "quarantined" again...
...but Windows Security still says "This program is dangerous and executes commands from an attacker."...
...We don't have a Microsoft account and so can't "report it to Microsoft".
...you are out of business until Microsoft does something.

Sounds like you want to have your cake and eat it too. False positives are a known problem of A/V for decades. If you choose to use one of the worst antivirus solutions known to man and woman, it is normal and expected to get an increased number of false positives.

However, you refuse to report to Microsoft and expect the Pale Moon devs to solve Defender's issues? As a user of the Windows OS and Defender, you are not gaining much privacy-wise by not having a Microsoft account...

It is simple really. As mentioned:

a) Exclude the entire Pale Moon folder from Windows Defender detection. That's what Defender can offer you: disable itself.
b) Start reporting all false positives to Microsoft (doing their job for them).
c) Use a proper antivirus.

[wavymoon]

Ok just got this problem on startup (non) of PM. I would like to know how to exclude the PM folder from Defender's 'defense'.
I am glad I have an unupdated portable PM to work with or...

BTW I did not notice a message from WDefender that it had done anything.