Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Opening instances of Firefox results in Malwarebytes blocking a connection to xml.clk1013.com

  • 5 replies
  • 5 have this problem
  • 1 view
  • Last reply by FredMcD

DaveFF
DaveFF
more options

Hi,

I usually have 3, 4 or more instances of Firefox running on my desktop PC (Windows Vista), which I open one-by-one. Until a few months ago all was fine but, more recently, the majority (but not all) of the times I open each new Firefox window a few seconds later a Malwarebytes pop-up reports the following:

MalwareBytes Anti-Malware Malicious Website Blocked

Domain: Xml.clk1013.com IP: 174.137.155.139 Port: 0 Type: Outbound Process:

I am curious as to what the site is and why this is happening. I have MalwareBytes and another similar program on a paid-for subscription, plus another 2-3 other similar free programs that I run monthly. I keep up-to-date with Firefox and other software updates and have antivirus installed (Kaspersky). Hence I doubt there is any virus or malware lurking.

Interestingly, 3 of the instances of Firefox are used to open my own HTML-coded pages, which are simple lists of links. This suggests the pop-up is being triggered by an Add-on.

Without going through all my Add-ons (of which there are quite a few) and trying to work out one-by-one which is the source of the issue (if, indeed, that is where the issue lies), I thought I'd throw it open to the community to see if anyone has any ideas. Thanks in advance.

Hi, I usually have 3, 4 or more instances of Firefox running on my desktop PC (Windows Vista), which I open one-by-one. Until a few months ago all was fine but, more recently, the majority (but not all) of the times I open each new Firefox window a few seconds later a Malwarebytes pop-up reports the following: MalwareBytes Anti-Malware Malicious Website Blocked Domain: Xml.clk1013.com IP: 174.137.155.139 Port: 0 Type: Outbound Process: I am curious as to what the site is and why this is happening. I have MalwareBytes and another similar program on a paid-for subscription, plus another 2-3 other similar free programs that I run monthly. I keep up-to-date with Firefox and other software updates and have antivirus installed (Kaspersky). Hence I doubt there is any virus or malware lurking. Interestingly, 3 of the instances of Firefox are used to open my own HTML-coded pages, which are simple lists of links. This suggests the pop-up is being triggered by an Add-on. Without going through all my Add-ons (of which there are quite a few) and trying to work out one-by-one which is the source of the issue (if, indeed, that is where the issue lies), I thought I'd throw it open to the community to see if anyone has any ideas. Thanks in advance.

Chosen solution

Found it. It's the extension IE Tab PLUS. This allows the correct display in Firefox of pages written specifically for display in IE, that otherwise do not render correctly in Firefox.

IE Tab PLUS contains the "Window Shopper" module, while IE Tab + (sic) is the same extension but without that module. See: http://coralietab.mozdev.org/ http://www.shouldiremoveit.com/WindowShopper-92645-program.aspx

IE Tab PLUS is an extension I've had for some years, so it has been successfully clocking up a 'hit' every time I've opened Firefox. I now realise that MalwareBytes started to block these outbound connections when I commenced the paid-for subscription to MalwareBytes, which of course includes real-time protection. It was missed by the scans because the "Window Shopper" module is actually part of the code of IE Tab PLUS.

What I'll do is remove IE Tab PLUS and install IE Tab V2 instead (another alternative, which is a bit newer than IE Tab +). Note I don't see IE Tab PLUS in https://addons.mozilla.org/ any more; I suspect it was pulled some time ago.

Thanks for making me persevere with this.

Read this answer in context 👍 0

All Replies (5)

FredMcD
FredMcD
more options

This domain is used by the RevenueHits Ad Network

You may have ad / mal-ware. Further information can be found in the Troubleshoot Firefox issues caused by malware article.

Run most or all of the listed malware scanners. Each works differently. If one program misses something, another may pick it up.

Separate Issue; Your System Details shows;

Installed Plug-ins

Adobe Shockwave for Director Netscape plug-in, version 12.0.2.122 Adobe Shockwave for Director Netscape plug-in, version 12.1
Having more than one version of a program may cause issues. You must remove the older programs. Then get the current full installer.

Shockwave Director: Shockwave Standalone Installer / Uninstaller{web link} Shockwave Director Version 12.1.9.159 http://get.adobe.com/shockwave/

DaveFF
DaveFF Question owner
more options

Thanks for making me persevere on the malware route. It does make sense.

I have run the suggested malware scanners (Microsoft Safety Scanner & SUPERAntiSpyware Portable Scanner), including those I routinely use (Adwcleaner, Hitman Pro, JRT, tdsskiller, and Malwarebytes, two of which I have on subscription).

Only Microsoft Safety Scanner identified a vulnerability (Exploit:Java/CVE-2010-0840), which supposedly only affects Oracle Java SE and Java for Business 6 Update 18 and earlier - my version is up-to-date and so unaffected. I did notice I had two updates (Java 8 update 31 and Java 8 update 60), so I removed the old one [as well as the older version of the two Shockwave programs I had - well-spotted!] .... but unfortunately the problem persists.

I am now trying Firefox in safe mode and, so far, the problem has not recurred. It occurs most times I open a new browser window although not all, so I will use it in safe mode for a few days to be absolutely sure. If all remains well then it suggests a plug-in is causing the issue and I guess I'll have to work through them, disabling them one by one, until I can identify the culprit. Intriguing!

Thanks for your suggestions so far.

FredMcD
FredMcD
more options

Safe Mode is a troubleshooting mode that temporarily turns off hardware acceleration, resets some settings, and disables add-ons (extensions and themes). If the problem goes away, that tells us one thing. If it does not, that tells us something else.

Plugins are not effected.

Modified by FredMcD

DaveFF
DaveFF Question owner
more options

Chosen Solution

Found it. It's the extension IE Tab PLUS. This allows the correct display in Firefox of pages written specifically for display in IE, that otherwise do not render correctly in Firefox.

IE Tab PLUS contains the "Window Shopper" module, while IE Tab + (sic) is the same extension but without that module. See: http://coralietab.mozdev.org/ http://www.shouldiremoveit.com/WindowShopper-92645-program.aspx

IE Tab PLUS is an extension I've had for some years, so it has been successfully clocking up a 'hit' every time I've opened Firefox. I now realise that MalwareBytes started to block these outbound connections when I commenced the paid-for subscription to MalwareBytes, which of course includes real-time protection. It was missed by the scans because the "Window Shopper" module is actually part of the code of IE Tab PLUS.

What I'll do is remove IE Tab PLUS and install IE Tab V2 instead (another alternative, which is a bit newer than IE Tab +). Note I don't see IE Tab PLUS in https://addons.mozilla.org/ any more; I suspect it was pulled some time ago.

Thanks for making me persevere with this.

FredMcD
FredMcD
more options

That was very good work. Well Done.

Fire IE (FireIE, Enhanced IE) {web link} Embeds Internet Explorer(IE) to use the powerful Firefox add-ons. Not only an enhanced IE Tab, but also an enhanced Internet Explorer with Adblock Plus and FireGestures support. Switch to the IE engine in one click and dismiss your IE.

Open in IE™ {web link} Open links in Internet Explorer