Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just installed Little Snitch on my Mac. When I start up Firefox it now popups with the above warning.

I can't seem to find any information regarding sype-transport or port 9911, beyond that it is used for SypeCom transport protocol.

Anybody can help enlighten me?

share|improve this question
    
(As an aside: your user name prohibits @user comment reply notifications. See How do comment @replies work? for details.) –  Arjan Dec 19 '10 at 23:23
    
Could be a firefox addon. Try disabling them all then re-enabling till it appears again. –  MrStatic Dec 20 '10 at 0:08
    
@arjan - thanks. didn't know about this feature. –  w-- Dec 20 '10 at 7:12
    
@mrstatic - hmm i doubt it, i just have adblock plus, web developer and firebug.... i have many more including these installed on other computers and don't see this behaviour.... –  w-- Dec 20 '10 at 7:15
    
So, where did you download your copy of Firefox? –  Arjan Dec 20 '10 at 7:35
show 1 more comment

2 Answers

crowdcache1.stonekitty.net appeared in the download for Firefox 3.6.13.I DID NOT run the file!Instead, My security software scanned the file and tagged it a "ZOMBIE": a file that terminates itself so as not to alarm anti-virus programs. It can, under certain conditions on your computer, launch malicious code from a remote hacker. When I tried to download Firefox 3.6.13 again, Mozilla's name as publisher was on the download AS IT SHOULD BE! How crowdcache1.stonekitty.net got there is a question for Mozilla. You may well have a malware infection.

share|improve this answer
    
hmmm that's scary.... :( question asked on mozillazine forums. thanks for the reply Big Jim. forums.mozillazine.org/viewtopic.php?f=38&t=2058431 –  w-- Dec 20 '10 at 7:10
add comment

It appears it is/was/could have been a mirror site for Mozilla?

For instance, this page http://mytopfiles.com/programs/file/Firefox-Setup-4-0/431156.htm shows stonekitty.net & below various mirrors. (It does not show the particular port.)

I picked one of the mirrors, "saudi.net.sa".

Going here, http://www.mozilla.org/community/mirrors.html, I find neither "stonekitty" nor "saudi".

Though viewing the source of the page, I do find, "href="http://mozilla.saudi.net.sa", so you would expect that to be legit?

Perhaps stonekitty was at one time a mirror?

In any case, what I surmise above proves nothing.

Do you still have the downloaded file? If so, you can easily verify its validity, ftp://ftp.mozilla.org/pub/firefox/releases/3.6.13/SHA1SUMS.

(And in any case, 3.6.13 is dated & you should update to 3.6.17.)

share|improve this answer
    
I just ran into this too. Very weird. Stonekitty is listed at that mirror site though as a secondary mirror. Not that I trust them with my browser. –  mlissner Sep 29 '11 at 20:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.