Is there a legit reason for firefox.exe to send a datagram to 80.82.201.94 or 80.82.201.86, a hosting service located in the Seychelles, remote port 443?
It is sent from my computer, Local address 0.0.0.0. from a whole big range of local ports via TCP, Direction: Out.
All Replies (5)
HI, your going to have to explain the issue better, provide the logs in your post please that you are Identifying as Firefox talking
If a tab is left open it will refresh and extensions will be working also so please detail how you have decided that Firefox is not doing what it is suppose to be doing.
Suggest you run a scan, malware or anything else you find is not Firefox problems it means your security is not tight enough : Please : use more than 1 scanner as each uses diff tech :
Save your Report and google each before deleting anything as do not want to delete something you need, If need help :
Post in only 1 forum, then wait.
Please let us know if this solved your issue or if need further assistance.
Modified by Shadow110
Thank you for responding. When Firefox.exe slowed down, I checked the log of my modem (Arris SBG6950AC2 cable modem). Found strange outgoing and incoming datagrams from places like Chile, Seychelles Islands, Novosibirsk, Sofia Bulgaria, etc.). I attach a file with an example of that. I personally looked up these locations via their IP's on MYIP.MS. I then went to my Avast Internet Security Firewall and blocked many of them. I attach a screenshot of a log of suspicious blocked traffic from Avast firewall. It looks like an ongoing port-scan to me. I could be wrong, as it could be legitimate Internet traffic. (Given that I am located in North Dakota, use www.msn.com hotmail for my e-mail, and have zero connections with anything or anyone in the Seychelles, or Russia, or Bulgaria, I thought this stuff "blockworthy".) Also, I do not use any porn sites, no gambling sites, weird stuff, no drugs, no dark web, and I generally click only on well-known, approved websites with a "safe rating" from the Avast internet security services. It might have come in on the Wifi network, via wife or daughters cell-phone, who knows.
The other side of this is that neither Malwarebytes Premium scan, or the Threat Scan from Avast finds anything wrong with this. Likewise, I don't know whether they are even looking at things of this nature, because it is simply too difficult to distinguish good from bad.
Yet, the sneakiness of current malware may be such that it presents itself as part of the usual web traffic. Looking at "Windows Task Manager" in Windows 7, I can see that several of the instances of firefox.exe keep adding and adding memory usage, until either the webpage, or the e-mail page simply crashes (at about 1,300,000k mem used). What does that symptom mean?
Please note that the JPEG files have been virus-scanned via Avast and Malwarebytes. I also admit to the possibility of being slightly paranoid about computer safety, as opposed to many people, including my own family members, who just go about their web business with the "bliss that comes with not being informed at all", and such.
Apart from this, a rather simple question for Firefox experts would be: Does Firefox.exe have any reason (business connection, ISP contract, etc) that would require it to make contact with Quasi Networks Seychelles?
This is very unusual. Firefox can connect with mozilla and sometimes with google or amazon cloud. These are servers located in the USA in your case.
Suspicious addons?
Sorry, July 4 intervened. I use Firefox Version 61 I have not added a single Add-on Got three extensions: 1) Avast Online security (Browser Security and Web Reputation Plugin) 2) Avast SafePrice (Comparison shopping utility) 3) HTTPS Everywhere Themes: Default Theme Plugins : 1) OpenH264 Video Codec provided by Cisco Systems, Inc. (Automatically installed by Mozilla) 2) Widevine Content Decryption Module provided by Google Inc. (Automatically installed by Google) Is this ok?
Other than that, I have been keeping on blocking stuff coming from "iffy countries" (like NK, RU, Vietnam, China, Korea, and tiny islands like Curacao). How does one really decide what is and what is not dangerous? I am puzzled.
HI, my Norton logs are full of port scans constantly as well as Malwarebytes trying to scan Norton all the time even when I have given the folders exceptions.
Run all programs with a Right Click and run as Administrator so they are granted elevated permissions in their scans. Could go as far as reboot to safe mode with network support and Admin Privileges then scan.
I own this one and trust the company and have dealt with their support so please give this one a try : https://www.adlice.com/download/roguekiller/ Can use the Portable one if do not want to install it. Suggest please to keep using the other scanners on the list in the 1st response. The more the better as all scan differently, including Eset which do not allow to delete on it's own as it does find False/Positives.
As not a security company I suggest you keep all the logs of the scans then go to the URL I provided for Malwarebytes (been there, done that ) and download the tools they ask for then submit all your logs for them to review.
My guess is you do have something in your system due to the varied degree of countries. Such as being part of a bot net.
Please also reboot your Router as was requested in June by the FBI : https://www.washingtonpost.com/news/posteverything/wp/2018/06/06/why-the-fbi-wants-you-to-reboot-your-router-and-why-that-wont-be-enough-next-time/?noredirect=on&utm_term=.b1cf72b0e438 Also to see if there is any firmware for a update to it.
Please let us know if this solved your issue or if need further assistance.
Modified by Shadow110