Gmail and 4 News feeds all stopped working

[Thundordan]

Hello,

Something baffling has happened. It baffles me. I am baffled.

Baffle. Last night I caught my 4 RSS Feeds and my Gmail disappearing all of a sudden. But here's the interesting part: the Gmail meter, instead of disappearing, it started showing the emails from a DIFFERENT gmail account (an old one I don't use any more, hence the 1559 unread mails), one that I have never entered the credentials for in any rainmeter-related file. ever.

Here's a screenshot: http://i.imgur.com/PiDbM.jpg

- no skins/configs/variables files were changed in any way. (checked all I could think of)
- my gmail username and password variables haven't changed. The Configuration menu shows them correctly.
- I tried entering the urls for the feeds and the gmail manually (replacing

Code: Select all

Url=https://#GmailUsername#:#GmailPassword#@gmail.google.com/gmail/feed/atom

with

Code: Select all

Url=https://aThirdGmailUsername:andItsPassword@gmail.google.com/gmail/feed/atom

) with NO CHANGE. (but if I comment out the ;URL= completely, it stops showing the 1559 messages.)
-restarted rainmeter, windows, triple checked every .txt and .ini I could think of.

So obviously some thing has messed rainmeter up somehow somewhere. But what?
When this happened, I was indeed working with this "1559" gmail account. I was in the middle of installing the google video chat plugin for gmail on the PC and at the same time I added the "1559" account to pidgin and logged in along side another gmail account and a yahoo.

How could any of these things mess up rainmeter? They have nothing to do with it. Also, I have uninstalled any trace of google stuff off my pc and removed the 1559 account from pidgin, no luck.

Please shed some light on this craziness

I've been running this setup for almost 2 years, customizing it every now and then, I've never seen something like this

[Kaelri]

My theory is a little crazy. But as they say, once you have eliminated the impossible, then whatever remains, however improbable, must be the truth. In short: if no changes have been made in Rainmeter, then the change must have been made outside of Rainmeter. Your connection to e.g.

Code: Select all

Url=https://aThirdGmailUsername:andItsPassword@gmail.google.com/gmail/feed/atom

is, for some reason, being redirected to this alternate account's feed. Your disappearing feeds tell me that the issue is not specifically related to Gmail, but seems to be a general connection problem.

First, I'd like you to try opening the third account's feed URL in your browser, and see if the same thing happens. This will tell us if it's still a general problem, or if it's specific to Rainmeter.

Second, a possible solution. Go to Control Panel > Internet Options > Connections > LAN Settings, and see if you have a proxy server enabled. If you do, disable it, then refresh Rainmeter. (And run a malware scan at your earliest opportunity, because if your computer is connecting to a proxy server and you didn't tell it to, that's pretty much always the result of malware.)

If that doesn't work, try changing the password on the 1559 account and see if Rainmeter still gets the feed. If it does, I would theorize that Rainmeter is not actually connecting to the account, but is rather receiving data from a cached file of some kind, since it can't create a new connection. If you have "Download=1" and/or "DownloadFile" set on your WebParser measures, remove them and see if it makes a difference.

You may also want to try installing a portable copy of Rainmeter, add copies of your skins to it, and see if it displays the same behavior. In the worst-case scenario, you can completely remove and reinstall your primary Rainmeter setup.

I'll be honest, I'm really grasping at straws here. Absent a really crazy bug in the Google Talk plugin, it doesn't even seem possible.

[jsmorley]

I would also be quivering with suspicion about some malware attack at this point. I would run MalwareBytes AntiMalware as soon as possible.

[Thundordan]

My theory is a little crazy. But as they say, once you have eliminated the impossible, then whatever remains, however improbable, must be the truth. In short: if no changes have been made in Rainmeter, then the change must have been made outside of Rainmeter. Your connection to e.g.

Code: Select all

Url=https://aThirdGmailUsername:andItsPassword@gmail.google.com/gmail/feed/atom

is, for some reason, being redirected to this alternate account's feed. Your disappearing feeds tell me that the issue is not specifically related to Gmail, but seems to be a general connection problem.

First, I'd like you to try opening the third account's feed URL in your browser, and see if the same thing happens. This will tell us if it's still a general problem, or if it's specific to Rainmeter.

Second, a possible solution. Go to Control Panel > Internet Options > Connections > LAN Settings, and see if you have a proxy server enabled. If you do, disable it, then refresh Rainmeter. (And run a malware scan at your earliest opportunity, because if your computer is connecting to a proxy server and you didn't tell it to, that's pretty much always the result of malware.)

If that doesn't work, try changing the password on the 1559 account and see if Rainmeter still gets the feed. If it does, I would theorize that Rainmeter is not actually connecting to the account, but is rather receiving data from a cached file of some kind, since it can't create a new connection. If you have "Download=1" and/or "DownloadFile" set on your WebParser measures, remove them and see if it makes a difference.

You may also want to try installing a portable copy of Rainmeter, add copies of your skins to it, and see if it displays the same behavior. In the worst-case scenario, you can completely remove and reinstall your primary Rainmeter setup.

I'll be honest, I'm really grasping at straws here. Absent a really crazy bug in the Google Talk plugin, it doesn't even seem possible.

Hi guys, thanks for answering.

"First, I'd like you to try opening the third account's feed URL in your browser, and see if the same thing happens."
- I did. I tried manually connecting to my primary gmail account (the one that's supposed to be shown in rainmeter), the 1559, and my troll account ( , the third one). They all work properly in the browser, displaying different and corresponding RSS feeds. (the same for the escapist news feed for example)
Considering I get the same mail feed in rainmeter no matter what credentials I enter, and considering it works in the browser, that list must be populated from a cache. But it still is weird, as I've never actually connected to my 1559 account from Rainmeter. ever. (so where did the emails come from in the first place? did someone else write the cache? (google?) where is this rainmeter rss cache stored?)
Furthermore, when I reset the gmail skin, it takes 3 seconds for the mail list to get populated. This suggests that it's actually waiting on something.

"see if you have a proxy server enabled."
- I do not. I don't use one. The internet options show in the Local Area Network (LAN) Settings window that everything is unchecked, the proxy is grayed out and "Automatically detect settings" is checked. (Could "automatic" mean there could be a proxy and me not knowing?)
I'm running a Spybot Search and Destroy scan, I'll see what that tells me.

"try changing the password on the 1559 account and see if Rainmeter still gets the feed"
- I have changed the password to the 1559 account, but rainmeter still shows them; no change. This definitely means there's a cache problem going on.

"If you have "Download=1" and/or "DownloadFile" set on your WebParser measures, remove them and see if it makes a difference."
- I've Ctrl+f'd "download" in my Gmail-reader.ini, and no hits. There are references to "Plugin=Plugins\WebParser.dll" however. Is there something I can do with the dll? Or could there be a global "Download=1" enabled somewhere else in rainmeter?

"You may also want to try installing a portable copy of Rainmeter".
- I haven't tried this yet, but will do this some time this weekend, if nothing else solves the problem.

In case I do have to reinstall rainmeter, could you tell me if there are any files I have to look out for, to save, except the actual skins and perhaps the variables? (ie does rainmeter store important stuff in AppData or Roaming or whatever?) So I wouldn't lose anything. (I would especially not like to lose the positions of the skins, as some of them are custom and aligned by hand)

[EDIT] Spybot says it's all good, except for a couple of cookies. I am getting Malwarebytes now.
[EDIT2] Question about Malwarebytes: When it says "Successfully blocked access to a potentially malicious website: *some IP*" in process utorrent.exe, does this mean it thinks that guy is bad or does it just block random peers that I'm trying to connect to? (should I add utorrent as an exception in real time protection?)
[EDIT3] So MalwareBytes found some malware, mostly keygens , nothing related. I've cleaned everything up and still no rainmeter change.

[Edit4] My News RSS Feeds have magically came back to life! Just like that. I swear I didn't do anything.
My Gmail feed is still stuck on the 1559 mails account though...

This sounds like whatever was supposed to connect my Rainmeters to the internet wasn't working, and so the skins were forced to show cache instead. But how come the news works but gmail still doesn't? (tried 2 accounts, but still only shows what the 1559 used to have)

[Thundordan]

Holy noodles!

This is madness, my gmail meter is NOT fetching mails from some cache after all. I sent a couple of test mails to the 1559 account and now it has 1561, displaying them "correctly" in rainmeter!
Even though I've changed the passwords to all my 3 gmail accounts. The Rainmeter settings have a no longer working password saved, and the user name is obviously not the one being displayed.

I AM LOSING MY MIND HERE

But I went to settings, set the username to ASDESRHGSDFGARE and password to QRASTSADDSFA, saved, refreshed, then gmail was blank! Then I went back and entered the correct info and it worked!


Bottom line is: the only thing I hadn't modified in the variables so far was the username. which was for my main google account. Once fidled with that, things went back to normal.

I still think what happened was impossible though.
How could rainmeter keep fetching new emails from an old account that I had changed the password to, TWICE?
Furthermore, I had also tried hardcoding the user and password to each of my 3 accounts in the URL of the gmail feed (instead of using variables), with no luck, the old account still being accessed.
The only explaination I can think of, is that Rainmeter could somehow access the email feed of whatever gmail account I was logged in with, in my open browser at the time. (though I kept switching between iexplorer and firefox, not using chrome, to figure out if it isn't chrome related)

Anyway, yeah. That happened... Still no idea why the news feeds started working on their own either.

[jsmorley]

It is an issue with IE. What we are finding is that if you are "logged in" to GMail through IE, so there is a cookie saved for a GMail account, even if you have closed IE while still logged on, you can get this behavior.

WebParser uses a Windows API function that connects to websites via a call to a subset of Internet Explorer. For some reason, at least recent versions of IE seem to be using any "active" cookies stored in IE, even though the calling application is not Internet Explorer itself. So if you are logged into GMail to account "xx" in IE, any GMail skins in Rainmeter that have an incorrect or missing id and password will still retrieve that account information. This can cause some unexpected behavior.

I'm not 100% sure if this is something new in IE 8/9 or has always been lurking out there. We are looking into it. In my opinion, this is a hideous breach of security by Microsoft, as a cookie stored locally by IE should not be automatically used by any application other than IE just using this API call. It would be trivial to write some malware that just hits GMail, Facebook, World of Warcraft account page, whatever though this call to IE, with a hope that a user had closed IE while still logged on and left a huge back door into personal information.

In the meantime, just for the love of all that is holy, get Firefox or Chrome or Opera or something and stop using IE. It is crap, it has always been crap, and it always will be crap. At a minimum, be sure that if you are using Rainmeter skins to access two different accounts, you have the correct id and password for each account in the skin so you don't get conflicts.

This only happens if you are logged into GMail (or any site that uses local cookies) via IE. It can happen even if your regular browser is something else, IF you used IE to log in, and the cookie has not expired.

[Thundordan]

Holy crap! I'm clearing the hell out of all my IE cookies!

I couldn't agree with you more on IE. I just used it now, to make sure it's not chrome related. I mainly use chrome and secondary is firefox.

It seems I've indeed stumbled upon a horrible breach in security. I(anyone) could steal a lulzboatload of information through this.
Thank you for figuring it out!

Cheers!

Never, ever using IE again, no matter for what purpose!