Suspicious Firefox 'double' Master Password request...

[sstbb]

I'm running FF 3.5.7 with master passwords turned on - this problem was also with 3.5.6
and perhaps earlier... THIS LOOKS LIKE LOGIN SPOOFING.  Details: When FF is started,
two (2) identical master password request forms/windows are displayed with the first
(#1) directly hidden by the second (#2).  #2 can either have ANY password entered
or NO password entered, then it goes away exposing the #1 password screen which
requires the correct password to continue.  Yes, I know this is the definition of an
infection with something, but I can not find it as of 1 month of searching with
Kaspersky, MSSRT, root-kit removers, Clorox (kidding).  I have removed all
add-on from FF except Java starter and .NET framework assistant.  I do
not want to slick and reinstall without identifying this piece of sh*t.

Anyway Great Ones, what do you suggest?  I'm stumped.

/bill

[katala]

Is this action easily duplicated, if so can you send a screen cap, or if its a URL you post the URL of the offending site?  I've not encountered a problem like this.

[sstbb]

The symptoms happen upon every start of FireFox - thus completely reproducible.
The second master password screen overlays the usual master password request.
No URL are involved - at least a far as the master password is requested before
any tabs are loaded.  That does not mean the original _infection_ did not come
from an infected website.  A single screen shot is attached showing the top
password request moved off the bottom (standard) password request.

[tanstaafl]

Are you using Weave or XMarks (formerly Foxmarks) or any other kind of syncing addon?

http://superuser.com/questions/86096/firefox-requests-the-master-password-twice

[sstbb]

Solution -  The previous post by tanstaafl  pointed to the URL:

http://superuser.com/questions/86096/firefox-requests-the-master-password-twice

with "a" solution.  Evidently, when FireFox is starting with default to open multiple tabs
and more than one of them has login information under Master Password system control,
then a Master Password is requested for each.  Thus, more than one password request
exactly as I'm seeing displayed.  I've confirmed for my installation by removing all
startup tabs except one.  Solved!

Thanks to Raphink for the following post at the above URL.

     I've had this happen when multiple tabs are opened on startup, and several
    of them require a password. Ganesh's answer seems to be a fix for that one.
                                                                  Raphink Jan 6 at 11:52

While I would not call this a bug, I would call it a VERY POOR instance of
interface design, since it enables confusion for actual LOGIN SPOOFING.

/bill