1

I just installed Little Snitch on my Mac. When I start up Firefox it now popups with the above warning.

I can't seem to find any information regarding sype-transport or port 9911, beyond that it is used for SypeCom transport protocol.

Anybody can help enlighten me?

Arjan
  • 30,974
  • 14
  • 75
  • 112
w--
  • 1,033
  • 4
  • 13
  • 25
  • (As an aside: your user name prohibits @user comment reply notifications. See [How do comment @replies work?](http://meta.stackoverflow.com/questions/43019/how-do-comment-replies-work) for details.) – Arjan Dec 19 '10 at 23:23
  • Could be a firefox addon. Try disabling them all then re-enabling till it appears again. – Unfundednut Dec 20 '10 at 00:08
  • @mrstatic - hmm i doubt it, i just have adblock plus, web developer and firebug.... i have many more including these installed on other computers and don't see this behaviour.... – w-- Dec 20 '10 at 07:15
  • So, where did you download your copy of Firefox? – Arjan Dec 20 '10 at 07:35
  • @arjan: original from mozilla. then the updates got from the ff update manager. – w-- Dec 21 '10 at 17:40

2 Answers2

0

crowdcache1.stonekitty.net appeared in the download for Firefox 3.6.13.I DID NOT run the file!Instead, My security software scanned the file and tagged it a "ZOMBIE": a file that terminates itself so as not to alarm anti-virus programs. It can, under certain conditions on your computer, launch malicious code from a remote hacker. When I tried to download Firefox 3.6.13 again, Mozilla's name as publisher was on the download AS IT SHOULD BE! How crowdcache1.stonekitty.net got there is a question for Mozilla. You may well have a malware infection.

Big Jim Slade
  • 1
  • hmmm that's scary.... :( question asked on mozillazine forums. thanks for the reply Big Jim. http://forums.mozillazine.org/viewtopic.php?f=38&t=2058431 – w-- Dec 20 '10 at 07:10
0

It appears it is/was/could have been a mirror site for Mozilla?

For instance, this page http://mytopfiles.com/programs/file/Firefox-Setup-4-0/431156.htm shows stonekitty.net & below various mirrors. (It does not show the particular port.)

I picked one of the mirrors, "saudi.net.sa".

Going here, http://www.mozilla.org/community/mirrors.html, I find neither "stonekitty" nor "saudi".

Though viewing the source of the page, I do find, "href="http://mozilla.saudi.net.sa", so you would expect that to be legit?

Perhaps stonekitty was at one time a mirror?

In any case, what I surmise above proves nothing.

Do you still have the downloaded file? If so, you can easily verify its validity, ftp://ftp.mozilla.org/pub/firefox/releases/3.6.13/SHA1SUMS.

(And in any case, 3.6.13 is dated & you should update to 3.6.17.)

therube
  • 1,446
  • 7
  • 6
  • I just ran into this too. Very weird. Stonekitty is listed at that mirror site though as a secondary mirror. Not that I trust them with my browser. – mlissner Sep 29 '11 at 20:35