Not sure if this is the correct group. If not let me know and I will repost where this might fit better. My Firefox is calling out to the IP 220.127.116.11 for no apparent reason.
My firewall reported outgoing tcp connection to the IP 18.104.22.168 by firefox. But that was while FF was opened it was only displaying the home page which is on this machine. So I added 22.214.171.124 to the FW block list and started tracking how often this occurred. And it happens a lot, every 15 minutes when Ff is open.
Suspecting it might be a "livemark bookmark" causing this, I removed the FF latest headlines bookmark. Nothing changed. tried disabling all extensions and plugins & again no difference. Blocklist, etc are all turned off as are all auto-updates in Ff. Add-ons = NoScript, Ghostery, AdBlock Plus, GreaseMonkey. FF version 3.6.28 ( in order to be exactly compatible with the other machines her that are old W2k machines.
This system is XP Home updates thru Feb 1st; OutPost FW; Eset Nod32 AV, Spyware Blaster, SpyBot 1.62 (no teatimer). This machine is scanned regularly with its AV, Malware Bytes & SuperAntiSpyware. And we follow pretty good security procedures here. Scans show nothing bad around. Yet I also find this same thing happening on the other machine near me that happens t be a W2k machine. Also this machine was wiped and completely rebuilt in November. And any data files transferred to it were thoroughly scanned before transferring.
With FF not started, no calls out. Start FF and immediately FF calls out to that IP 126.96.36.199. And continues to do that every 15 minutes.
BUT I have also discovered that the call outs stop if the machine is left unattended. Which makes this look even more serious. These machines generally run 2 to 7 email instances all the time and the FF browser. So when unattended the emails (Eudora) are running.
I found the IP 188.8.131.52 to be owned by Edgecast.net. Which is some kind of a content provider? But googling the IP I found that people think it is a questionable site.
Have been puzzling with this for a while now; hence the long post. Think I have every automatic connection stopped in the FF menus and its config file. But it's still happening.
Any body have any ideas?
next I think I will try "fiddler" to capture the outgoing packets when I let them thru. And create a new FF profile & test if it does the same thing. After that I guess it is uninstall FF and reinstall it.