paypal brodcast??

[Kateweb]

I just reinstalled Mozilla about a day ago because my laptop was restarting every time i opened it.

but now I'm seeing some weird stuff Ie I just loaded it and and it desided it qanted to brodcat to paypal.

so why ?

beast answer gets a cookie

[armadaender]

It's redirecting you to paypal everytime you open mozilla?

[Kateweb]

It's redirecting you to paypal everytime you open mozilla?

no not redirecting thank goodness , but it is brodcasting according to sygate i found it odd . it's ben weird since yesterday when i did the reinstall.

[armadaender]

no not redirecting thank goodness , but it is brodcasting according to sygate i found it odd . it's ben weird since yesterday when i did the reinstall.

That is bizarre. Another question, have you ran any spyware removal/anti virus apps since the install? If not then I would do so just in case this is some sort of spyware bullcrap.

Also, I've been looking around google for anything that could explain why this would occur but nothing has come up. I'll continue looking once I get back from class later today. Good luck, I'm sure Sparda or VaKo would have a better idea as to that could be going on.

[moonlit]

Going along the spyware route, you're sure it's the real PayPal?

[VaKo]

Is your homepage set to paypal?

Does it reset your homepage to paypal if you change to to about:blank? Have you done an anti-wankware/virus scan recently? Are you running any extensions or scripts on firefox? Were you before the reinstall? Has your IE6 homepage been set to something wank, then copied when you installed firefox again?

For a last try: go to C:Documents and Settings<un>Application DataMozillaFirefoxProfiles<profile name>.default, copy "bookmarks.html" somewhere else, and delete C:Documents and Settings<un>Application DataMozilla. Uninstall firefox, then reinstall it, fire it up again to see if its worked. If it has, close it again (very important step) and copy your bookmarks back into your new profile. 100% cleanish install with your old bookmarks.

no not redirecting thank goodness , but it is brodcasting according to sygate i found it odd . it's ben weird since yesterday when i did the reinstall.

I'm really not sure what you mean by "its broadcasting"... exactly what is broadcasting what? (we'll need logs/screenshots etc).

[armadaender]

no not redirecting thank goodness , but it is brodcasting according to sygate i found it odd . it's ben weird since yesterday when i did the reinstall.

I'm really not sure what you mean by "its broadcasting"... exactly what is broadcasting what? (we'll need logs/screenshots etc).

I believe she means that it's sending data to paypal upon start-up of the app.

[VaKo]

Crank up Wireshark, start a capturing, then let firefox do what it wants. The logs should show you if you should be worried or not. Not sure exactly what is causing this from the information given (we need logs, or screenshots). So my 30 second quickfix is thus:

• Do a full virus/crapware scan. Paranoia set to 11.

If nothing shows up, backup your bookmarks, then delete your profile and unistall firefox.

Reinstall firefox (do not copy any settings from IE6), and do a quick test. If its still trying to connect to paypal, the problem is with windows. Maybe a OS reinstall would fix this, (its certainly quicker and more reliable than digging the crap out of your system if you have a nasty on it). If not and everything is fine, copy your bookmarks back to your profile, and enjoy.

But we need more info about this if were going to be able to fix it. My suggestions are along the line of "hit it, hit it again, if its not fixed throw it out and get a replacment".

[Kateweb]

ok i run adawre and spybot daily, I do have the following extentiens installed

1 ) tab mix Plus 0.3.0.5

2) colorful tabs 1.4

3) fireFTP 0.94.3 ( i know i don't nead it but i keep forgetting how to do the ftp log in and this just make my life easier)

4) torbutton 1.0.4

5) talkback 1.5.0.7

and as of about an hour ago IE tab 1.1.06

All are the lattest versions.

As for my home page, it is the defult Mozilla/Google page

I don't know if it was realy paypal the ip address by the looks of my logs was 216.168.252.103 .

a back trace came up with nothing but ***.

I did end up reinstalling firefox im not seeing pay pall but their are a lot of odd ip's in my logs but seeing as thay are blocked I think I'm ok , For the moment at leat.

[armadaender]

IP address: 216.168.252.103

Reverse DNS: seal.verisign.net.

Reverse DNS authenticity: [Verified]

ASN: 7342

ASN Name: VERISIGN-AS

IP range connectivity: 4

Registrar (per ASN): ARIN

Country (per IP registrar): US [united States]

Country Currency: USD [united States Dollars]

Country IP Range: 216.168.192.0 to 216.168.255.255

Country fraud profile: Normal

City (per outside source): Manassas, Virginia

Private (internal) IP? No

IP address registrar: whois.arin.net

Known Proxy? No

Link for WHOIS: 216.168.252.103

216.168.252.103 = Verisign's website, not paypal.

Still is rather interesting.

[Kateweb]

yea weird it has seemed to stop or at leat hasen't ben happaning again I wish I thought to get a screen shot of the origianl incident mabee if it happens again well be able to saulve the mistary.

now only if i had a laptop monitor .......