Odd FF3 Problem... sucking up bandwidth

[PaladinMJ]

Whenever I open FF3 I notice Netmeter's speed gage showing my download speed spiked out to max. I have run Spybot search and destroy.. Windows defender, Spyware doctor, mcafee security suite and a-squared Anti-Malware without detecting anything unusual. I'm going crazy trying to find out the problem. I'm assuming malware, Trojan/virus etc. but can't find anything running that I can't verify. And the problem is only when I use Firefox not I.E. but a good few of the sites I visit absolutely will not work right in IE.

I have even run Hijack this, and don't think i see anything that is odd. Though I admit my knowledge of Hijackthis is not good. Process explorer shows nothing odd, neither does tcpview that I can tell.

If you all need more info please let me know. Any help solving this will result in some credits heading your way as thanks for relieving the frustration. I've been at this for 8 or 9 days now i guess.

 

[justice]

what addons are you using? Foxmarks for example will sync your bookmarks on start depending on your settings.

[housetier]

or maybe it's trying to download an update...

[Lashiec]

Also, Firefox does call home on startup for various things (checks for addons updates, renew the phishing and malware blacklists, etc.). How much data is being downloaded and during how much time?

[f0dder]

The thing you need to tell us is whether this is just a momentary spike, or if it's like that all the time you're running firefox. As other people have already suggested, there's legitimate reasons for a (relatively) short spike at startup.

[PaladinMJ]

The thing you need to tell us is whether this is just a momentary spike, or if it's like that all the time you're running firefox. As other people have already suggested, there's legitimate reasons for a (relatively) short spike at startup.

-f0dder (August 21, 2008, 10:38 PM)

right, i realized that i was unclear about the length of time that the issue was taking. it is constant until i close ff3, if i leave it up 7 hours straight it steals all my download bandwidth for 7 hours.
sorry it took me so long to get back to you all, i was afraid that i might be spraying malware out to others and had yo get my other system set up in a more accessible location.

what addons are you using? Foxmarks for example will sync your bookmarks on start depending on your settings.

-justice (August 20, 2008, 04:56 AM)

I have disabled all addon's except adblock, greasemonkey (with 3 scripts I wrote that i know the problem, paypal plug in, and IEtab.

[tomos]

just to test, make a new "clean" profile & see has that the same problem

[nosh]

You could use a net monitoring utility or a firewall to see which server(s) it's connecting to.

[Lashiec]

Process Explorer is able to show to which servers is Firefox connected, by clicking on "Properties" of the "firefox.exe" process, and going to the "TCP/IP" tab. Still, is weird to see malware only working when Firefox is open, and is not visible in physical form (toolbar, plugin, etc.). Try to disable all addons as well.

[PaladinMJ]

first off..thanks to all!

secondly, i found the issue and boy am i steamed! it was the paypal add-on for ff3!
I happened to notice the same problem on a different system and did some scouring to see what the common link was. it was the add-on, once that was eradicated everything is fine.

the reason I'm steamed is twofold, one its the legitimate plug-in.. its not infected or modified at all. so what are they trying to do? second I uninstalled the plug-in weeks ago after a 2 hour trial run in a sandieboxed ff3. so how/why  it ended back in there behind my back i ain't sure. but i did some md5 comps against the legit version and they match so....yeah anyway issue resolved.

[Lashiec]

the reason I'm steamed is twofold, one its the legitimate plug-in.. its not infected or modified at all. so what are they trying to do? second I uninstalled the plug-in weeks ago after a 2 hour trial run in a sandieboxed ff3. so how/why  it ended back in there behind my back i ain't sure. but i did some md5 comps against the legit version and they match so....yeah anyway issue resolved.

-PaladinMJ (August 24, 2008, 01:02 AM)

Well, if you deinstalled it in the sandboxed session, and the plugin was installed before that session, there you have the answer. If not... :S

As for the constant downloading, contact the devs and let them know about the issue.

[PaladinMJ]

Well, if you deinstalled it in the sandboxed session, and the plugin was installed before that session, there you have the answer. If not... :S

As for the constant downloading, contact the devs and let them know about the issue.

-Lashiec (August 24, 2008, 01:45 PM)

Oh I have Lashiec, as I feel that unless us users report the issues we have with a programmers work we can not  really blame them for its short comings especially since we didn't do a better job did we now ? 

and no.. i didn't install unsandboxed uninstall sandboxed lol that would be hard to do actually.. well i think it would at least with sandboxie