Firefox1 : wants to go on line on startup?

Hi

I'm trying out Firefox1 - new to this browser so apologies if I'm missing something basic here!

whenever I launch Firefox it wants to put me on line straight away; allowing it to do so I find that it is trying to contact axolotl.mozilla.org:80 and also seemingly the page I last visited (in last browing session), although only my home page displays

my home page is a purpose-made page local to this computer, which only has links to other local pages, not to anything on the internet...

...so why is it making these two internet accesses pls?

==

other small puzzle - although Firefox has a good-looking icon, I don't see it in the task bar or at the top left of Firefox's title bar. Instead I see the "4 coloured panes" Windows icon; is this normal pls?

TIA and best wishes, HJ

 

Hugh,

For your autodial on startup, you can edit your preferences to stop autodial in Firefox by using about:config:

Clear the Location Bar, then type: about:config
In the Filter field type: network.autodial
This setting should appear: network.autodial-helper.enabled
Right click the setting
Select: Modify
Change the value from true to false



You can change the Windows icon in the upper left corner to the Firefox icon:

Download this icon: http://community.wvu.edu/~ast002/main-window.ico
Place it in the Mozilla Firefox default located here:
C:\Program Files\Mozilla Firefox\chrome\icons\default folder.
If there is no "icons" folder then create the folder, and then a "default "
subfolder under the icons folder.

When you restart the Firefox, the Firefox icon should then appear instead of the Windows icon.

Let us know if you continue to have problems.

Ramona

Edited to include adding icons and default subfolders.

 

Ramona

thankyou for your speedy reply...

re: the icon - as there was originally no "icons" subfolder under C:\Program Files\Mozilla Firefox\chrome I created the path afresh as given in your post to place the downloaded icon file. This worked perfectly - thanks it looks much better now!

re: trying to put me on line on startup - using about:config I found network.autodial-helper.enabled was set "true ". No modify option on right-click! - so "toggle "d the boolean to false... but unfortunately no change in behaviour.

I've returned to about:config (after reboot) to check that the modified value had "stuck" OK - indeed it shows "false ". (seriously useful highlighting of the modified values!)

But, still the same two internet accesses upon starting Firefox.

Only this confuses me a bit more now; firewall showed accesses to both axolotl.mozilla.org:80 and 212.58.226.30:80 (is BBC news website), as before. As before, only my local home page showed up.

...but it's more confusing because the last site I accessed wasn't the BBC site this time, it was BBS to read your reply. So why on earth has it gone back to the BBC site - not even the last site I browsed?

I hope this is down to me doing something silly...

There's IE6 and Opera7.54 on this computer - could there be any interaction from the history trails of these other browsers - seems a bit of a long shot... And a NIC is fitted but not plugged into anything. It's W98SE fully patched on a 600MHz Pentium3.

best wishes, HJ

 

Hugh,

Good going on creating the folder and getting the FF icon in place.

On your startup problem. Have you cleaned up your History file lately? You can do that in Windows Explorer ( with FF closed ) deleting the history.dat file.

Do you have AIM or any other Messaging program installed? These programs often trigger dialup, but usually have a program configuration which can be disabled. MSMessenger is also one of the culprits.

Ramona

 

the plot thickens

Hi again

further investigation yields:

I can do Tools>Options>Privacy, clear everything, and the two internet accesses (as above) still happen

(screenpic to follow)

regarding the access to 212.58.226.30:80

when this internet address gets accessed as a result of starting Firefox, I receive 11,527 bytes; this figure seems reproducible as far as I can tell;

if I actually go to this internet address I get served the BBC news front page; but, many more bytes are transferred when I make the access myself;

the size 11,527 doesn't tally with either the size of the BBC page, its graphic elements, or the IFrame (ticker) contained therein. As yet, I haven't matched the 11,527 to anything.

I can start Opera or IE without anything invoking DUN or anything else "odd" happening - it seems to be only Firefox.

very puzzled - partucularly the way it still does it when I've cleared everything. Perhaps I'd better run Adaware, Spybot etc...

best wishes, HJ.

edit - after seeing post about clearing History: all I had cleared to get the situation described above was everything I could find to clear from Firefox's Tools menu. It won't hurt me at the moment to clear the whole computer's everything so will try that (slowly, section by section, try to see what wipes it). Will surely post back results but may take a while - sleep long overdue! Thanks again, HJ

 

Hugh,

Routinely clear these files/folder:

Cache folder
history.dat file
XUL.mfl file

All located in the *.slt folder.

Ramona

 

Ramona

the only History.dat I could find was in

C:\WINDOWS\Application Data\Mozilla\Firefox\Profiles\ioj6ungc.default\

(did I select "same settings for all users" when installing perhaps? that might have been Opera. I would have gone for "same settings" if it were an available option)

...which path also contained a folder "Cache" and the file XUL.mfl, so first (Firefox not running) I deleted the file History.dat, and tried starting Firefox to see what happened. Result: same basic behaviour, only slightly less bytes received from the BBC site (so the figure I gave above isn't constant as I'd thought)

next try: deleted History.dat, XUL.mfl, and the entire contents of the Cache subfolder. Result - same again I'm afraid - or rather very nearly the same. This time the BBC access was made to 212.58.226.40:80 (which gives you the same BBC news front page) - and again a slight alteration again in the number of bytes received.

(these figures are only ~25% of the actual size of the news page, or ~10% if you include the images as well as the page)

The accesses to axolotl.mozilla.org remained substantially the same throughout as far as I can tell...

from Kerio earlier pic as promised

- so it's down to things like clearing the history trails of the other browsers and Adaware etc I suppose? - which I shall surely do, but 'twill have to wait till tomorrow as I'm truly bicycled, and I'll have to back up a few things first. But will go carefully and try to take it in as logical an order as I can...

if it were some **** site I could almost believe it easier! - but the BBC? It seems very strange... and surely worth finding out the root cause.

will check back for further suggestions / ideas before I start "pruning "...

thanks, and best wishes, HJ

...two tyred...

 

Hugh,

When I enter axolotl.mozilla.org:80 in the Location Bar, and access it, this is the page I see:

Yet, you see BBC? Strangeville! This is a mind bender, and I'm really stumped here, but still looking for answers, so don't think that I've abandoned you...

Have you done a thorough Virus Scan, and run Adaware and Spybot? Also, run Hijack This. If you don't have these programs you can download them here:
AdAware - Freeware - http://www.lavasoftusa.net/
SpyBot - Freeware - http://security.kolla.de/
Hijack This - Freeware - http://www.net-integration.net/tools/hijackthis.html

Ramona

 

Ramona

sorry for not having posted back earlier, strangeville indeed it is; many things found and many ruled out - but no nearer yet to either a cause or a resolution... here's what I've done so far:

made a backup of the current state of play; then

"normal" checks: Scandisk found a few files with invalid dates, including Firefox's compreg.dat. "Fixed" this with scandisk (though not 100% happy with result, but I think that's sidetrack) - no change in Firefox behaviour;

All the other files with invalid dates were within the Java which comes with Opera. Checking the Opera / Java installation on the other computer I find the same pattern - I think ?it may be "par for the course "; so (checking after each move):

uninstalled Opera's Java;
cleared IE and Opera history / cache / cookies - everything clearable I could find;
uninstalled Opera;
Adaware - detected "mainpean" which is a nasty including a dialler: removed with Adaware;
uninstalled, then reinstalled Firefox...

and guess what - it still does it!

==

so now I'm reloading a minimal OS set which is known malware-clean but will check it anyway, and will install Firefox over that to see what happens.

Also will try installing Firefox on the other computer - same browsers on that computer, same Opera Java RTE, same bad dates! - hopefully not same malware will check first.

- and will post back - again, please forgive me if it takes a while, hands rather full!

have read with interest what you say about axolotl.mozilla.org - curious. I don't think the BBC visit is immediately beforehand - hard to tell but if anything I'd say the BBC access is made very slightly later... if it were the BBC access referring me across to axolotl, I would have probably seen that. Probably.

This is probably a red herring but it's weird: checking my startups (msconfig) I found a run-once for the mdac patch (which stays there). Was puzzled when WindowsUpdate blessed me with the MDAC thing again; more perturbed now I find the "sticky" run-once. Considering the mainpean malware - might be worth asking over in SVS when the dust's settled...

best wishes, HJ.

 

curiouser and curiouser...

fresh OS; checked with Adaware (same check as spotted the malware last time) showed nothing untoward, only Alexa...

installed Firefox, standard install (not custom), didn't import anything (favourites, history etc)

started Firefox first time: accesses to axolotl, the BBC at 212.58.226.30:80 and also 66.102.11.99:80 which a whois lookup shows as GOOGLE-2

this time round I was having to let it out through the firewall (no rule in place to start with) so I can confirm that the BBC access was definitely after axolotl (socket #1036 at my end) and Google (socket #1038); the BBC was at socket #1043

(I didn't see #1037 or the other intervening socket numbers)

Kerio taken after I let through the first access from Firefox (singly) but before I'd created a rule

oh dear...

==

have done a full AV scan on both C: and F: (data partition) without finding anything (defs are up to date)

about the only thing left is to clear a spare HDD, fit it as the only drive, format and load W98 fresh from CD, and try again like that...

==

there's no chat or instant messaging software involved, I don't have any...

gloom!

best wishes anyway, HJ.

 

Ramona

have finally cleared another HDD, fdisked(!) new W98 and all - only to find that with a bit more thought and a play with the firewall I didn't really need to... but got a bit put off with the other browsers and the malware. It wasn't anything to do with them though... the fresh installation produced essentially the same behaviour

a few answers:

the BBC thing: is just to pick up the "Latest Headlines" (opening this in tabs is really neat, I've just tried it for the first time)

the axolotl thing: is not necessarily serving the apache test page, it's probably something else altogether (see below). But they haven't replaced index.htm at the server - they've left the default test page. Without any file there an apache would tend to serve the actual index of the folder (ie the list of files contained therein). Withough knowing the name of the file(s) being requested it's hard to suss what's happening here, though...

the putting me on line thing: this is still problematic. It's the axolotl and BBC accesses which do it - and I haven't yet found out a way to stop Firefox requesting these automatically (have set network.autodial-helper.enabled to false, but that doesn't stop it).

there's a whole lot of things it could be doing - along the lines of just checking its MD5s perhaps? (it's not MD5s though, because only 657 bytes come back)

best wishes, HJ

 

finally(!) sussed...

the internet accesses (both) are down to having a "live bookmark" (out of the box, not one I'd added intentionally), delete the bookmark and they vanish

the axoltl thing is accessing http://fxfeeds.mozilla.org/rss20.xml which causes the accesses to the BBC (but just going to the fxfeeds URL doesn't produce the same result - live bookmarks have to be added by their own method) (I should have read the instructions better )

best wishes, HJ.

 

Hugh,

Thank you for reporting back with the cause of your problem. I'm not at all certain that the Live Bookmarks would occurred to me. Glad that it's fixed, and you're in control again!

Ramona

 

Ramona & Hugh ...

The axolotl.mozilla.org:80 address is puzzling because I don't get what either of you get. When I enter it in the address window, I'm immediately redirected to http://axolotl.mozilla.org/ which is a page of links to various other Mozilla pages.

Re "live bookmarks ". I had a problem, a month or so back, where Firefox opened at the page I was viewing when I closed it after the previous use. This certainly isn't an option, the closest thing to it being having Firefox open at a specific bookmark.

I never did find out whether something I had done caused it, or whether it was a glitch in the program, as it went away after a few builds (I was upgrading almost daily at that time).

Firefox ... a work in progress!