firefox always running

User Help for Mozilla Firefox
Post Reply
RAiZ0R
Guest

firefox always running

Post by RAiZ0R »

hi all, i have a strange problem. i try to keep a fairly clean system running at all times. i regularly visit the task manager closing down unused apps to free up my pitiful memory. anyway lately i have noticed that there is always a process called firefox.exe running. i kill it with end task and it restarts immediately. i am lost as to why this is happening. (it is using only a very small amount of memory, maybe 3 Mb, compared to normal firefox.exe at 20+ Mb)I jsut cannot get rid of it and i have googled this problem to no avail.. Pleaze someone have any advice as to what is causing this. Thanks
K8L
Posts: 10
Joined: October 2nd, 2006, 11:15 am
Location: France

Post by K8L »

Hi RAiZ0R

Several people have the same problem... This problem isn't related to firefox... If you uninstall firefox and make IE as your default browser, iexplore.exe is gonna launch by itself the same way. It is probably trying to connect to a remote IP on port 3640... I think it is a virus. I'm not sure if it is related or not, but my PAYPAL account has been hacked. Erase all your password list.

This morning, I don't know what happened, explorer.exe crashed. Then when it reloaded, there was a window "Custom setting initialization" or something like that (I have french OS)... Then when explorer.exe reloaded, firefox.exe wasn't in processes anymore... I rebooted, no more firefox.exe in process anymore ! So u can try to kill explorer.exe process and see what happens.

Check this :
http://forums.mozillazine.org/viewtopic.php?t=467349
http://forums.mozillazine.org/viewtopic.php?t=470618

I hope we'll find an explanation to this... It's making me nervous (none of the spyware remover / antivirus i tried have found anything!)

Please tell me if it's getting better when u kill explorer.exe process.

See you!

UPDATE:
Have you ULTRAVNC 1.0.1 installed ?
-= K8L - LECLECTIC.ORG =-
K8L
Posts: 10
Joined: October 2nd, 2006, 11:15 am
Location: France

Post by K8L »

Connecting to port 3460 - very likely its the trojan poison ivy.
I found it 12 hours ago and wireshark told me its connecting to mmohacks.no-ip.info on port 3460.
Use Spy Sweeper to get rid of this.
(Guest message on another thread)
-= K8L - LECLECTIC.ORG =-
Guest
Guest

Post by Guest »

Hi K8L
i killed explorer then i killed the firefox.exe. i restarted explorer and guess what no more funny fireox is running . it didnt come back...yet
thanks for the advise i will try to get spy sweeper as you advised. thanks again its good to know im not alone in this problem but bad to think of what could be causing this :)
K8L
Posts: 10
Joined: October 2nd, 2006, 11:15 am
Location: France

Post by K8L »

glad it worked!

spy sweeper didnt find anything thought... maybe is it a variant?

it seems that killin explorer solves the problem then =)
-= K8L - LECLECTIC.ORG =-
Ayu
Posts: 7
Joined: October 6th, 2006, 8:55 am

Post by Ayu »

I killed explorer.exe and then that small firefox.exe, rebooted, and it is still here. ):

I have been battling this thing since yesterday; I even did a clean install of Firefox, after which it worked for a while.
RAiZ0R
Guest

Post by RAiZ0R »

i got spysweeper which found a few threats. i removed them but i dont know if they were related to this problem or not. Anyway firefox.exe still hasn't restarted which is great. Only problem is i havent restarted my pc since i killed explorer. hopefully it wont come back when i restart computer. If it does i'll let you all know. thanks
Ayu
Posts: 7
Joined: October 6th, 2006, 8:55 am

Post by Ayu »

It came back for me once I made Firefox my default browser again. It simply attaches itself to the default browser...

Spysweeper did not detect it for me.
shafe
Guest

anyone find a solution?

Post by shafe »

I am having the same problem, blocked the process from accessing the net on port 3460, but I cant have explorer running or it will execute this "hijacked" firefox process, which I agree is scary. Anyone find a solution to this? I'm wondering if I run a system repair if it will clean the explorer or not.
Michael Cole
Guest

Damn! Winsafe.exe

Post by Michael Cole »

windows/system32/winsafe.exe

kill explorer.exe in task manager.
File->Run->cmd
use shell to delete winsafe.exe
"type winsafe" to see all your keystrokes. Time to change those passwords!
del winsafe

Keep an eye on it in case it has a program to reinstall itself.

winsafe.exe calls itself firefox.exe in the Task Manager. Tricky!
User avatar
the-edmeister
Posts: 32249
Joined: February 25th, 2003, 12:51 am
Location: Chicago, IL, USA

Post by the-edmeister »

A mind is a terrible thing to waste. Mine has wandered off and I'm out looking for it.
Post Reply