Results 1 to 5 of 5

Thread: Firefox alerts while Firefox is running

  1. #1
    gmt Guest

    Default Firefox alerts while Firefox is running

    I am periodically getting popup alerts for Firefox while Firefox is
    already running. The IP address in question looks fairly sane,
    considering sites that are currently tabbed, and appears to
    relate to a tab that is being refreshed. A check of Ethereal
    traces tends to confirm this ( but I am only beginning to learn
    how to use this tool )

    I have both wiped the ZA database as well as done a clean install,
    and the behavior continues.

    Any clues ?

    Operating System:Windows XP Pro
    Product Name:ZoneAlarm Pro
    Software Version:6.5

  2. #2
    Join Date
    Dec 2002
    Location
    Mikado Michigan
    Posts
    2,596

    Default Re: Firefox alerts while Firefox is running

    is it a new component of Firefox, or does it have a remember me box in the popup?
    My homes are SpywareHammer.com and DonHoover.net and BleepingComputer.com


    Consumer Security - 2011 & 2012

    Tilting at windmills hurts you more than the windmills.
    -From the Notebooks of Lazarus Long
    Senior of the Howard Families

  3. #3
    Join Date
    Dec 2005
    Posts
    9,057

    Default Re: Firefox alerts while Firefox is running

    Does the FireFox use a site advisor or phishing filter or adblock updater? These could be making the attempts for updates and this could be causing the alerts.

    Oldsod
    Best regards.
    oldsod

  4. #4
    gmt Guest

    Default Re: Firefox alerts while Firefox is running

    Thank you for your replies.

    No special plugins with Firefox. I always manually
    enable access when launching the tool.
    Actually all non-OS applications except for anti-virus are
    configured to "ask" for internet access...

    Normally, once Firefox has been launched,
    I don't see any more ZA popups. Now, I eventually see additional popups
    while browsing either (a) when a tabbed page auto-refreshes or (b)
    when I enter a new URL or follow a link. It's almost as if ZA has
    forgotten that Firefox was previously enabled.

    I have a pair of XP Pro systems with the same ZA engine (6.5.737) but
    only one shows this behavior.

    The ZA GUI logs typically show entries with the direction set to (data)
    and no other details. ZALog.txt shows entries such as the following:

    PE,2006/12/27,11:31:40 -8:00 GMT,Firefox,C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe,192.149.252.7:80,N/A

    The IP is for ARIN, and this event occurred while I tried to got to arin.net to check an address in ZALog.txt :-)

    (happened twice while I typed this note...)

    One thing that Ethereal revealed to me (which I did not know before), is that the 2Wire DSL router
    is periodically cycling it's address range, with one ARP per second. Probably some table refresh
    algorithm, I suppose. I can't see how that would be a problem. Doesn't bother the other system,
    in any case. (both are directly connected to the router -- no wireless involved)

    Is there anything I can do to help pinpoint what might be going on ?

  5. #5
    gmt Guest

    Default Re: Firefox alerts while Firefox is running

    other curiosities comparing two XP-SP2 systems running ZA.

    these are observed only on the funky system...

    - zlclient constantly shows up as an active program in the ZA summary
    (it is setup to "ask" for permission, but I haven't seen it do so...)

    - I see a pair of consecutive DNS requests to resolve pa2.zonelabs.com.
    After the first DNS response, I see an attempt to start up HTTP to a
    different address than what is reported ( goes to 69.226.92.102 rather
    than the two addresses in the query response -- 69.225.175.161, 69.225.175.163 ) ?!.
    A 2nd HTTP session opens up soon after to the same address ( could the address have been
    resolved earlier ? ).

    There is HTTP info in the packets that suggest
    that this is for pa2.zonelabs.com, but I'm not familiar enough with networking to
    know if this is accurate. The argument to the GET looks like gibberish, and the
    values are different for the two sessions.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •