Receiving files from myself?

[slate_leeper]

This morning when I first started Firefox, my proxy server told me I
was receiving several files, including an html page and a few image
files. I had just started Firefox, and had not entered any URL or
clicked any bookmark or link. Firefox did not display the page or any
images. The REALLY strange part - the proxy says that the IP address
the files are coming from is my own IP address. This has happened each
time I restarted Firefox.

? What the hey?


-danz-



Protect your civil rights!
Let the politicians know how you feel.
Join or donate to the NRA today!
http://membership.nrahq.org/default....ignid=XR014887

The true measure of a people's freedom is whether they are armed or not. - Aristotle

[Mike Easter]

slate_leeper wrote:
> This morning when I first started Firefox, my proxy server

Exactly what does 'my proxy server' mean in this context?

Define what your proxy server is and does for you.




--
Mike Easter

[slate_leeper]

On Thu, 29 Jul 2010 11:40:22 -0700, Mike Easter <MikeE@ster.invalid>
wrote:

>slate_leeper wrote:
>> This morning when I first started Firefox, my proxy server
>
>Exactly what does 'my proxy server' mean in this context?
>
>Define what your proxy server is and does for you.


The proxy server is the old Naviscope software. Among other things, it
displays each individual item coming in with a line such as "receiving
an image file from 123.456.701.234, xxx of xxxxx bytes received" or
"receiving an HTML page from 123.456.701.234." It also gives a
thermometer-style progress bar for each item. Other than that, it
blocks incoming ads and outgoing info such as referring page and
browser type. I have been using it for years.

-dan z-




Protect your civil rights!
Let the politicians know how you feel.
Join or donate to the NRA today!
http://membership.nrahq.org/default....ignid=XR014887

The true measure of a people's freedom is whether they are armed or not. - Aristotle

[Mike Easter]

slate_leeper wrote:
> Mike Easter
>> slate_leeper wrote:
>>> This morning when I first started Firefox, my proxy server

>> Exactly what does 'my proxy server' mean in this context?
>>
>> Define what your proxy server is and does for you.
>
>
> The proxy server is the old Naviscope software.

The old naviscope software developer is gone, its website is gone and
replaced by something else, there are no docs 'visible' at any of the
sites which provide downloads for this freeware and the descriptions
don't tell me enough about how it works to be sure about what is going on.

> Among other things, it
> displays each individual item coming in with a line such as "receiving
> an image file from 123.456.701.234, xxx of xxxxx bytes received" or
> "receiving an HTML page from 123.456.701.234." It also gives a
> thermometer-style progress bar for each item. Other than that, it
> blocks incoming ads and outgoing info such as referring page and
> browser type. I have been using it for years.

OK I think I understand its basic functions.

<your earlier cite>
> This morning when I first started Firefox, my proxy server told me I
> was receiving several files, including an html page and a few image
> files. I had just started Firefox, and had not entered any URL or
> clicked any bookmark or link. Firefox did not display the page or any
> images. The REALLY strange part - the proxy says that the IP address
> the files are coming from is my own IP address. This has happened each
> time I restarted Firefox.

I would say that your browser has been hijacked and the ware is trying
to put its own content (from your system) into the browser display.


--
Mike Easter

[slate_leeper]

On Fri, 30 Jul 2010 09:43:25 -0700, Mike Easter <MikeE@ster.invalid>
wrote:

>
>I would say that your browser has been hijacked and the ware is trying
>to put its own content (from your system) into the browser display.


I have, and have run, MalWareBytes. Spybot, Avira AntiVirus, and
Microsoft Malicious Software Tool. All have found nothing. Any
suggestions? Browser is Firefox with NoScript.

By the way, it didn't do it this morning.

-dan z-




Protect your civil rights!
Let the politicians know how you feel.
Join or donate to the NRA today!
http://membership.nrahq.org/default....ignid=XR014887

The true measure of a people's freedom is whether they are armed or not. - Aristotle

[Mike Easter]

slate_leeper wrote:
> Mike Easter

>> I would say that your browser has been hijacked and the ware is trying
>> to put its own content (from your system) into the browser display.

> I have, and have run, MalWareBytes. Spybot, Avira AntiVirus, and
> Microsoft Malicious Software Tool. All have found nothing. Any
> suggestions? Browser is Firefox with NoScript.
>
> By the way, it didn't do it this morning.

The site I usually recommend to sanitize is this one
http://www.techspot.com/vb/menu28.html Virus and Malware Removal

I like the strategy and the rigor with which the helpers are vetted.

A much simpler approach that might work for some situations such as
yours is to just go to a HiJackThis log place.

The problem with that simplification is that it isn't very thorough.


--
Mike Easter

[slate_leeper]

On Thu, 29 Jul 2010 11:09:20 -0400, slate_leeper
<bycy-r0bj@spamex.com> wrote:

>This morning when I first started Firefox, my proxy server told me I
>was receiving several files, including an html page and a few image
>files. I had just started Firefox, and had not entered any URL or
>clicked any bookmark or link. Firefox did not display the page or any
>images. The REALLY strange part - the proxy says that the IP address
>the files are coming from is my own IP address. This has happened each
>time I restarted Firefox.
>
>? What the hey?
>
>
>-danz-
>


The html page is being generated and sent by a Firefox addon called
Track Me Not. One of it's options is to produce a log. Another is to
show what phrases are currently being used for queries. Apparently it
does this via html, and sends it from me to me.

Just for further information - things that connect on browser startup:

The NoScript addon connects to secure.informaction.com for XPI
scripting.

Firefox or one of the addons connects to ocsp.godaddy.com for SSL
certificate data.

-dan z-







Protect your civil rights!
Let the politicians know how you feel.
Join or donate to the NRA today!
http://membership.nrahq.org/default....ignid=XR014887

The true measure of a people's freedom is whether they are armed or not. - Aristotle

[Mike Easter]

slate_leeper wrote:

> The html page is being generated and sent by a Firefox addon called
> Track Me Not.

If I had installed something as weird as TrackMeNot, I think I would
remember it.

But thanks for the feedback anyway.

Bruce Schneier's blog on TrackMeNot 2006 Aug --
http://peek.snipr.com/103oac ... Let's count the ways this doesn't work.
.... it wastes a whole lot of bandwidth. A query every twelve seconds
translates into 2,400 queries a day, assuming an eight-hour workday. A
typical Google response is about 25K, so we're talking 60 megabytes of
additional traffic daily. ... The way serious people protect their
web-searching privacy is through anonymization.

--
Mike Easter