Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just installed Little Snitch on my Mac. When I start up Firefox it now popups with the above warning.

I can't seem to find any information regarding sype-transport or port 9911, beyond that it is used for SypeCom transport protocol.

Anybody can help enlighten me?

share|improve this question
    
(As an aside: your user name prohibits @user comment reply notifications. See How do comment @replies work? for details.) – Arjan Dec 19 '10 at 23:23
    
Could be a firefox addon. Try disabling them all then re-enabling till it appears again. – MrStatic Dec 20 '10 at 0:08
    
@arjan - thanks. didn't know about this feature. – w-- Dec 20 '10 at 7:12
    
@mrstatic - hmm i doubt it, i just have adblock plus, web developer and firebug.... i have many more including these installed on other computers and don't see this behaviour.... – w-- Dec 20 '10 at 7:15
    
So, where did you download your copy of Firefox? – Arjan Dec 20 '10 at 7:35

crowdcache1.stonekitty.net appeared in the download for Firefox 3.6.13.I DID NOT run the file!Instead, My security software scanned the file and tagged it a "ZOMBIE": a file that terminates itself so as not to alarm anti-virus programs. It can, under certain conditions on your computer, launch malicious code from a remote hacker. When I tried to download Firefox 3.6.13 again, Mozilla's name as publisher was on the download AS IT SHOULD BE! How crowdcache1.stonekitty.net got there is a question for Mozilla. You may well have a malware infection.

share|improve this answer
    
hmmm that's scary.... :( question asked on mozillazine forums. thanks for the reply Big Jim. forums.mozillazine.org/viewtopic.php?f=38&t=2058431 – w-- Dec 20 '10 at 7:10

It appears it is/was/could have been a mirror site for Mozilla?

For instance, this page http://mytopfiles.com/programs/file/Firefox-Setup-4-0/431156.htm shows stonekitty.net & below various mirrors. (It does not show the particular port.)

I picked one of the mirrors, "saudi.net.sa".

Going here, http://www.mozilla.org/community/mirrors.html, I find neither "stonekitty" nor "saudi".

Though viewing the source of the page, I do find, "href="http://mozilla.saudi.net.sa", so you would expect that to be legit?

Perhaps stonekitty was at one time a mirror?

In any case, what I surmise above proves nothing.

Do you still have the downloaded file? If so, you can easily verify its validity, ftp://ftp.mozilla.org/pub/firefox/releases/3.6.13/SHA1SUMS.

(And in any case, 3.6.13 is dated & you should update to 3.6.17.)

share|improve this answer
    
I just ran into this too. Very weird. Stonekitty is listed at that mirror site though as a secondary mirror. Not that I trust them with my browser. – mlissner Sep 29 '11 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .