173822 - QuickLaunch opens an IRC port to Netherlands

Status: VERIFIED WORKSFORME

(Core Graveyard :: QuickLaunch (AKA turbo mode), defect)

Description

[Bob Goldberg]

whenever quicklaunch is allowed to start on its own; it establishes an [I
ASSUME] irc channel - IT OPENS A TCP CHANNEL TO PORT 6667 !!!!!

the final location of this open port CHANGES!!!! - BUT - it's always somewhere
SUSPICIOUS!!!!  (other side of the world)

this is a CRITICAL SECURITY RISK!!! - I have not sniffed the traffic to see
what's going on - I just shut it down in my firewall - 

HOW DO I STOP THIS FROM HAPPENING?????

tia - Bob

Comment 1

[Boris Zbarsky [:bzbarsky]]

A quick grep through the Mozilla source shows that there is no occurrence of the
string "6667" anywhere in quicklaunch code... Have you considered running a
virus scan?

Comment 2

[Bob Goldberg]

I did indeed! - in fact it was the first thing I did after discovering the open
port. I shut down all open apps, disabled all startup apps & startup services;
updated my virus defs on 2 different pc's (different virus scan apps); scanned
the entire system with both apps (mcafee & pc-illin) - system came up clean.

afterward, I started restarting startup apps & services 1 @ a time, and kept an
eye on open ports.

I discovered that if I enabled the mozilla quicklaunch, on bootup this port
would open up to some VERY suspisious IP. if I disabled quicklaunch, rebooted,
started mozilla, the port would remain closed - it seems to only open up when
quicklaunch is enabled, and on reboot.

it always opens port 6667, but the destination varies...

I became suspicious of something wrong, when my firewall reported that mozilla
wanted to start server services; although I'm not sure if this is a direct link
to the open port - I don't understand why mozilla is requesting a server service
either...

I haven't spent any more time tracking down what server services mozilla wants
to start - I was more concerned with the open port...

HTH - Bob

Comment 3

[Jo Hermans]

I can't imagine why quicklaunch would launch IRC automatically. QuickLaunch
doesn't do normally anything, not even a automatic mail-check (which would be
useful). You shouldn't see anything, as long as there's no browser, mail or irc
window open. But we can check what's going on. I'm on my Mac now at home, but
I'll check my office-PC in an ahour to see if I can find something.

0. first things first
What version of Mozilla are you running ? See Help -> About Mozilla.

1. the connection itself
What ip-address is it trying to connect ? I can try testing al pre-configured
IRC-networks (IRCnet, EFnet, etc ...) to see if it's one of the official ones.

2. IRC itself
Have you every used IRC with this profile ? Can you check if your configuration
contains some traces of this ?

Check about:config, and look around extensions.irc.* . When they're blue instead
of green, they have been altered from the default. Do your have
extensions.irc.initialURLS or initialsScripts set to something ?

3. SMTP/POP/IMAP connections
Just to make sure, check your mail and news configuration, to see if all those
servers are still correct.

4. plugins
Can you check the list of your plugins (about:plugins), and see if something
'weird' is installed.

5. extensions and themes
Have you ever downloaded some special extensions or themes to Mozilla ?

6. do you still see the behaviour after you rebooted the PC ?

Comment 4

[Jo Hermans]

Reporter, have you seen this behaviour *after* you rebooted Mozilla ?

Comment 5

[Grace Bush]

Reporter,

Is this still a problem?  Will you respond to questions so we may investigate here?

Comment 6

[Jo Hermans]

Setting this to WORKSFORME because no comments have been received, and no
duplicates have been filed. Reporter, you can always reopen when you see the
problem again.

Comment 7

[Grace Bush]

verified