X
Tap here to go to the mobile version of the site.

Support Forum

When opening a tab Malwarebytes blocks 198.134.112.243 (outbound) - how to stop it at source?

Posted
    • Warning **

Clicking the box 'automatically add' causes all the written text posted here, to dissappear. This is soul destroying, especially when people (me) are having a hard time.

This is what I got: We're sorry, but we can't find what you're looking for. The page or file you requested wasn't found on our site

I clicked 'back' expecting the worst ... and I wasn't wrong.

! That button needs modding or deleting as a priority !

I understand the 'volunteer' aspect (thanks to everybody) ... but, we shouldn't be losing data like this.

At very least, you could edit the text, and advise people to save their work, before clicking the button. Good luck with that ;)


When opening a tab :

1) Unknown software exception (0xc0000409) occurred in the application at location 0x00406b64

2) Malwarebytes blocks 198.134.112.243 (outbound)


My Efforts to fix this


Read through Mozilla Support 'suggested docs' - advising to clean out malware

ESET found a few things MB misssed Hitman found a few things ESET missed

Checked 198.134.112.243 google transparency and phishtank - result : clean  Scanurl : invalid URL

Removed majority of cookies & cleared cache. Refreshed Firefox (as per your recommendation)

Ran IP Location Find:

Geolocation data from ipinfo.io (Product: API, real-time)

IP Address Country Region City 198.134.112.243 United States New York Westbury

ISP Organization Latitude Longitude Webair Internet Development Company Inc. Webair Internet Development Company Inc. 40.7570 -73.5814


Is the 'URL connection' linked to the 'software exception'?

Does the software exception indicate where the malware lies.

Should I re-install Firefox?

Does anyone have experience of this problem, and know how to fix it?

** Warning ** Clicking the box 'automatically add' causes all the written text posted here, to dissappear. This is soul destroying, especially when people (me) are having a hard time. This is what I got: We're sorry, but we can't find what you're looking for. The page or file you requested wasn't found on our site I clicked 'back' expecting the worst ... and I wasn't wrong. ! That button needs modding or deleting as a priority ! I understand the 'volunteer' aspect (thanks to everybody) ... but, we shouldn't be losing data like this. At very least, you could edit the text, and advise people to save their work, before clicking the button. Good luck with that ;) ----------------------------------------------------------- When opening a tab : 1) Unknown software exception (0xc0000409) occurred in the application at location 0x00406b64 2) Malwarebytes blocks 198.134.112.243 (outbound) My Efforts to fix this ---------------------------- Read through Mozilla Support 'suggested docs' - advising to clean out malware ESET found a few things MB misssed Hitman found a few things ESET missed Checked 198.134.112.243 google transparency and phishtank - result : clean  Scanurl : invalid URL Removed majority of cookies & cleared cache. Refreshed Firefox (as per your recommendation) Ran IP Location Find: Geolocation data from ipinfo.io (Product: API, real-time) IP Address Country Region City 198.134.112.243 United States New York Westbury ISP Organization Latitude Longitude Webair Internet Development Company Inc. Webair Internet Development Company Inc. 40.7570 -73.5814 ----------------------------------------------------- Is the 'URL connection' linked to the 'software exception'? Does the software exception indicate where the malware lies. Should I re-install Firefox? Does anyone have experience of this problem, and know how to fix it?

Chosen solution

I understand what you are saying.

The thing is; we are testing a problem with the current config. ... and the results make sense.

If a bad tile (site link) appears in the tile space - the 'software exception' alarm rings.

Don't think that I've dumped this issue. I'm still gathering information.

I loaded another site ... it's tile appeared, and it too set off the alarm.

What were the shared elements of each bad tile?

Disqus comment system.

This is 'page related' forum software. The page topic forms the thread.

One joins the service, and can then comment on any web page that is using Disqus (you write your thoughts, and they are stored centrally).

How they earn their money, is presumably what is causing a problem.

I'm not an expert, but perhaps privacy badger, or ublock origin is interrupting connections.

Maybe it is the Firefox setup.

... but what I know is that the 3 sites using Disqus, when appearing as tiles, caused the software exception.

We are not experiencing a software glitch. This is a reaction to a repeatable event, with a common denominator.

If every tile created this problem, then sure, it would be a re-install. However, it is only specific sites.

The correct action would be to understand, what is the software exception? What action is triggering the alert.

The problem is that we are now beginning to tread on toes. Perhaps we just leave it at that.

Additional testing with other Disqus sites, is possible, but I have no doubt that the result will be the same.

We've learned something.

Time to move on methinks :)

Read this answer in context 0

Additional System Details

Installed Plug-ins

  • Adobe PDF Plug-In For Firefox and Netscape 11.0.12
  • Google Update
  • Google Updater pluginhttp://pack.google.com/
  • Office Live Update v1.5
  • DRM Netscape Network Object
  • DRM Store Netscape Plugin
  • Octoshape embedded video plugin
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Shockwave Flash 28.0 r0
  • 5.1.30514.0
  • NPWLPG
  • Npdsplay dll
  • Windows Presentation Foundation (WPF) plug-in for Mozilla browsers

Application

  • User Agent: Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0

More Information

jscher2000
  • Top 10 Contributor
8501 solutions 69429 answers

Helpful Reply

Sorry to hear the data retrieval didn't work; it shouldn't direct you to a different page, it should run in the background. Possibly something is blocked that caused the poor behavior. We can come back to that (we'll ask you to experiment with posting a new question in Firefox's Safe Mode).

I assume Malwarebytes doesn't find any malware on your system when you do a complete scan.

Two things come to mind:

(1) Bad extension?

One possible culprit would be an extension. You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:

  • Ctrl+Shift+a (Mac: Command+Shift+a)
  • "3-bar" menu button (or Tools menu) > Add-ons
  • type or paste about:addons in the address bar and press Enter/Return

In the left column of the Add-ons page, click Extensions.

Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove).

Some Legacy extensions are not actually disabled/removed until you restart Firefox. In that case, Firefox will display a link for that purpose and you can complete your work on the Add-ons page before clicking the link.

Any improvement?

(2) Problem tile?

As you know, Firefox's built-in new tab page has "tiles" for different pages in your history. If Firefox wasn't able to create a thumbnail for a page, it will re-retrieve the page in the background to create a new one. This can create unexpected behaviors on the new tab page.

For example: This telnet://ptt.cc/ keep triggering firefox launch application window whenever I opened a new tab

If the new tab page doesn't crash, you can use the steps there to clean up the problem tile.

Alternately, you can substitute a different new tab page using an extension such as New Tab Override (version 6.0.1 or earlier for Firefox 52):

https://addons.mozilla.org/firefox/addon/new-tab-override/versions/?page=1#version-6.0.1

Sorry to hear the data retrieval didn't work; it shouldn't direct you to a different page, it should run in the background. Possibly something is blocked that caused the poor behavior. We can come back to that (we'll ask you to experiment with posting a new question in Firefox's Safe Mode). I assume Malwarebytes doesn't find any malware on your system when you do a complete scan. Two things come to mind: '''(1) Bad extension?''' One possible culprit would be an extension. You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either: * Ctrl+Shift+a (Mac: Command+Shift+a) * "3-bar" menu button (or Tools menu) > Add-ons * type or paste '''about:addons''' in the address bar and press Enter/Return In the left column of the Add-ons page, click Extensions. Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove). ''Some Legacy extensions are not actually disabled/removed until you restart Firefox. In that case, Firefox will display a link for that purpose and you can complete your work on the Add-ons page before clicking the link.'' Any improvement? '''(2) Problem tile?''' As you know, Firefox's built-in new tab page has "tiles" for different pages in your history. If Firefox wasn't able to create a thumbnail for a page, it will re-retrieve the page in the background to create a new one. This can create unexpected behaviors on the new tab page. For example: [https://support.mozilla.org/questions/1169444 This telnet://ptt.cc/ keep triggering firefox launch application window whenever I opened a new tab] If the new tab page doesn't crash, you can use the steps there to clean up the problem tile. Alternately, you can substitute a different new tab page using an extension such as New Tab Override (version 6.0.1 or earlier for Firefox 52): https://addons.mozilla.org/firefox/addon/new-tab-override/versions/?page=1#version-6.0.1

Question owner

Thanks jscher2000 for your response :)

When I posted the text, it was all nicely formatted, but then when it appeared, I thought hmmm that's hard to read.

So first, I'll bring the thread up to date, using newly acquired knowledge.

... then I will follow through on your suggestions :)

... perhaps the new knowledge will help us focus on the two problems (that may or may not be related).

Consequently, after having a look through the revised text below, we can pick up our conversation :)


When opening a tab :

1) Unknown software exception (0xc0000409) occurred in the application at location 0x00406b64

2) Malwarebytes blocks 198.134.112.241 (outbound). Malwarebytes blocks 198.134.112.242 (outbound). Malwarebytes blocks 198.134.112.243 (outbound). Malwarebytes blocks 198.134.112.244 (outbound).

Note: The malware is blocked, therefore it seems to be attempting other connection options.


198.134.112.241 (to 244) appears to be owned by putrr18.com.

putrr18.com is famous for it's malware. A search reveals many references to removing it.

We must presume that they have changed the format, as putrr18.com is no longer mentioned.

Instead we only see the IP addresses.


The important fact is:

Malwarebytes. SpyBot. Superantispyware. ETES. Hitman.

... all failed to identify the malware (nor remove it).

This fact, makes the malware very interesting, and quite likely new.


MY EFFORTS TO FIX THIS PROBLEM

1) Ran the above anti-malware programs.

2) Refreshed Firefox.

This procedure removes extensions! Plugins remained the same ... all are set to 'ask', except 'openH264'.

Removed the majority of cookies, leaving only those that one would expect.

Cleared the cache.

The breakthrough was in discovering the source of the malware.

For this I used : https://ipinfo.io/198.134.112.242


jscher2000 suggestions

1) Extensions

Refresh dealt with this.

2) Tiles

This is a new suggestion.

I will now examine your linked documents, and probably clear the history.

it would be important information, is we learn that the malware is associated with the tiles.

Fingers crossed.

)
Thanks jscher2000 for your response :) When I posted the text, it was all nicely formatted, but then when it appeared, I thought hmmm that's hard to read. So first, I'll bring the thread up to date, using newly acquired knowledge. ... then I will follow through on your suggestions :) ... perhaps the new knowledge will help us focus on the two problems (that may or may not be related). Consequently, after having a look through the revised text below, we can pick up our conversation :) ------------------------------------ When opening a tab : 1) Unknown software exception (0xc0000409) occurred in the application at location 0x00406b64 2) Malwarebytes blocks 198.134.112.241 (outbound). Malwarebytes blocks 198.134.112.242 (outbound). Malwarebytes blocks 198.134.112.243 (outbound). Malwarebytes blocks 198.134.112.244 (outbound). Note: The malware is blocked, therefore it seems to be attempting other connection options. -------------------------------------- 198.134.112.241 (to 244) appears to be owned by putrr18.com. putrr18.com is famous for it's malware. A search reveals many references to removing it. We must presume that they have changed the format, as putrr18.com is no longer mentioned. Instead we only see the IP addresses. -------------------------------------- The important fact is: Malwarebytes. SpyBot. Superantispyware. ETES. Hitman. ... all failed to identify the malware (nor remove it). This fact, makes the malware very interesting, and quite likely new. -------------------------------------- MY EFFORTS TO FIX THIS PROBLEM 1) Ran the above anti-malware programs. 2) Refreshed Firefox. This procedure removes extensions! Plugins remained the same ... all are set to 'ask', except 'openH264'. Removed the majority of cookies, leaving only those that one would expect. Cleared the cache. The breakthrough was in discovering the source of the malware. For this I used : https://ipinfo.io/198.134.112.242 --------------------------------- jscher2000 suggestions 1) Extensions Refresh dealt with this. 2) Tiles This is a new suggestion. I will now examine your linked documents, and probably clear the history. it would be important information, is we learn that the malware is associated with the tiles. Fingers crossed. :)

Question owner

Hahahahaha!

Well jscher2000 ... Let's not count our chickens too soon, but ...

I deleted the browsing history (clearing the tiles), and then launched new tabs.

As of this moment, the problems have disappeared.

Try not to smile (yet). I'm going to now reboot.

Malware can return after a reboot.

I'll get back to you in 10 minutes ;)

Hahahahaha! Well jscher2000 ... Let's not count our chickens too soon, but ... I deleted the browsing history (clearing the tiles), and then launched new tabs. As of this moment, the problems have disappeared. Try not to smile (yet). I'm going to now reboot. Malware can return after a reboot. I'll get back to you in 10 minutes ;)

Question owner

Hahahaha!

One out of two aint bad :D

After the reboot, I have been unable to trigger the Malwarebytes blocker.

It looks like you were right (jscher2000).

Big smiles all round :)

What is interesting is, that after all my work on this issue, I made one very useful error.

After refreshing Firefox, and clearing dodgy cookies and the cache ... I didn't clear the browsing history.

If I had done that, we would never have drilled down to the tiles.

AND ... even when I cleared the entire history ... that was a mistake. I should have first cleared the tiles.

So ... the next time this problem crops up, I think that you can forcefully recommend that the tiles alone, should be first deleted (and then test).

This will entirely prove your theory. However, I am confident that you were correct.

It's a big win jscher2000 ... every reason for a smile of satisfaction.

Thank you for taking the time to help :)


Okay, so it seems that the software exception might not have been associated with the malware.

Of course, there is a chance that it was, and this annoying firefox application error (software exception) is a leftover problem.

When I open a new tab, I get that awful 'alert sound', and the dialogue box.

I'm thinking that maybe 'refresh' wasn't enough, and that a re-install is required.

What do you think?

Hahahaha! One out of two aint bad :D After the reboot, I have been unable to trigger the Malwarebytes blocker. It looks like you were right (jscher2000). Big smiles all round :) What is interesting is, that after all my work on this issue, I made one very useful error. After refreshing Firefox, and clearing dodgy cookies and the cache ... I didn't clear the browsing history. If I had done that, we would never have drilled down to the tiles. AND ... even when I cleared the entire history ... that was a mistake. I should have first cleared the tiles. So ... the next time this problem crops up, I think that you can forcefully recommend that the tiles alone, should be first deleted (and then test). This will entirely prove your theory. However, I am confident that you were correct. It's a big win jscher2000 ... every reason for a smile of satisfaction. Thank you for taking the time to help :) ------- Okay, so it seems that the software exception might not have been associated with the malware. Of course, there is a chance that it was, and this annoying firefox application error (software exception) is a leftover problem. When I open a new tab, I get that awful 'alert sound', and the dialogue box. I'm thinking that maybe 'refresh' wasn't enough, and that a re-install is required. What do you think?
Pkshadow 1072 solutions 14836 answers

Helpful Reply

Hi, it takes 7mins to do so : uninstall Firefox. Then Delete the Mozilla Firefox Folders in C:\Program Files , C:\Program Files(x86) & C:\ProgramData Then restart system. Then run Windows Disk Cleanup. (Note: This should be Pinned and run Weekly, If never done below expect 10's of gig's) Then run it again and click the button that says Cleanup System Files. Note: your Firefox Profile is saved. But you should make a back up before you do :

Reinstall with Current Release Firefox 61.0.1 with a Full Version Installer

You can try this, it is very powerful and all entries must be googled or can delete something you need. If need help post at their forum, https://www.bleepingcomputer.com/download/roguekiller/

Please let us know if this solved your issue or if need further assistance.

Hi, it takes 7mins to do so : uninstall Firefox. Then Delete the Mozilla Firefox Folders in C:\Program Files , C:\Program Files(x86) & C:\ProgramData Then restart system. Then run Windows Disk Cleanup. (Note: This should be Pinned and run Weekly, If never done below expect 10's of gig's) Then run it again and click the button that says Cleanup System Files. Note: your Firefox Profile is saved. But you should make a back up before you do : *https://support.mozilla.org/en-US/kb/back-and-restore-information-firefox-profiles *https://support.mozilla.org/en-US/kb/export-firefox-bookmarks-to-backup-or-transfer Reinstall with Current Release Firefox 61.0.1 with a Full Version Installer *https://www.mozilla.org/firefox/all/ You can try this, it is very powerful and all entries must be googled or can delete something you need. If need help post at their forum, https://www.bleepingcomputer.com/download/roguekiller/ Please let us know if this solved your issue or if need further assistance.
cor-el
  • Top 10 Contributor
  • Moderator
17267 solutions 156055 answers

You can also check the about:networking page (e.g. DNS tab) to see if that gives some information.

You can also check the about:networking page (e.g. DNS tab) to see if that gives some information.

Question owner

Other than the software exception, the malware appears to be gone.

The reinstall ... in my experience always takes longer than 10 minutes, because everything has to be checked.

However, thanks for all the links and advice. I'll do it, but first, I must get some work done ... this problem has already absorbed two days.

I'll report back to this thread, once completed.

Rogue Killer

I checked the reviews. They weren't all good.

It looks like the prog will find anything suspect, but the tolerances of what is suspect, might be too broad.

I believe that your advice (to proceed with caution) is correct.

about:networking

I think that this would have provided another view of the malware connection - thanks for the tip.

It's not clear to me, if it can help us identify the software exception. Any guidance would be well received :)

Current Status

There remains the software exception when opening a new tab:

Unknown software exception (0xc0000409) occurred in the application at location 0x00406b64

If nobody has an idea of where to look for the cause of this glitch ... then I will re-install Firefox, and report back

Other than the software exception, the malware appears to be gone. The reinstall ... in my experience always takes longer than 10 minutes, because everything has to be checked. However, thanks for all the links and advice. I'll do it, but first, I must get some work done ... this problem has already absorbed two days. I'll report back to this thread, once completed. Rogue Killer I checked the reviews. They weren't all good. It looks like the prog will find anything suspect, but the tolerances of what is suspect, might be too broad. I believe that your advice (to proceed with caution) is correct. about:networking I think that this would have provided another view of the malware connection - thanks for the tip. It's not clear to me, if it can help us identify the software exception. Any guidance would be well received :) Current Status There remains the software exception when opening a new tab: Unknown software exception (0xc0000409) occurred in the application at location 0x00406b64 If nobody has an idea of where to look for the cause of this glitch ... then I will re-install Firefox, and report back

Question owner

UPDATE

The software exception has stopped.

I am wondering if the 'tiles space' needed to fill up with new tiles.

I'll see how it is after a reboot etc. Hopefully, this problem has solved itself.


While testing this space, I clicked the Mozilla Community tile: https://contribute.mozilla.org/

Unable to connect.

and MDN tile: https://developer.mozilla.org/en-GB/?utm_source=mozilla&utm_medium=firefox-tile&utm_campaign=default

Not Found.

These two tiles must be out of date :) I've deleted them.

UPDATE The software exception has stopped. I am wondering if the 'tiles space' needed to fill up with new tiles. I'll see how it is after a reboot etc. Hopefully, this problem has solved itself. -------------------------- While testing this space, I clicked the Mozilla Community tile: https://contribute.mozilla.org/ Unable to connect. and MDN tile: https://developer.mozilla.org/en-GB/?utm_source=mozilla&utm_medium=firefox-tile&utm_campaign=default Not Found. These two tiles must be out of date :) I've deleted them.

Question owner

PROBLEM ALMOST FULLY UNDERSTOOD

The software exception occurs when a tile to a site (presumably) does something incorrectly.

What, I'm not sure.

I loaded web pages to : www.thecheckeredflag.co.uk www.f1i.com

These became tiles. The software exception occurred.

I deleted these two tiles, and the software exception stopped.

They are both apparently good, normal websites. However, on loading, they trigger other connections to ad sites and disqus commentary etc.

These connections can be seen using about:networking (as suggested by cor-el) :)

I note that www.thecheckeredflag.co.uk cannot be loaded by Chrome for security reasons, yet it loads just fine in Firefox.

The site has good content, but maybe their affiliates are using unnaceptable data gathering techniques.

Either way, I believe that we have identified the 'surface cause' of the software exception.

It must be the case that the suspect tiles, are asking Firefox to do something that it doesn't want to do.

That's interesting. ... and now, there is no need for a re-install.

I guess that this provides us with our conclusion.

The software exception functions as a warning, that a site may be suspect.

Great!

PROBLEM ALMOST FULLY UNDERSTOOD The software exception occurs when a tile to a site (presumably) does something incorrectly. What, I'm not sure. I loaded web pages to : www.thecheckeredflag.co.uk www.f1i.com These became tiles. The software exception occurred. I deleted these two tiles, and the software exception stopped. They are both apparently good, normal websites. However, on loading, they trigger other connections to ad sites and disqus commentary etc. These connections can be seen using about:networking (as suggested by cor-el) :) I note that www.thecheckeredflag.co.uk cannot be loaded by Chrome for security reasons, yet it loads just fine in Firefox. The site has good content, but maybe their affiliates are using unnaceptable data gathering techniques. Either way, I believe that we have identified the 'surface cause' of the software exception. It must be the case that the suspect tiles, are asking Firefox to do something that it doesn't want to do. That's interesting. ... and now, there is no need for a re-install. I guess that this provides us with our conclusion. The software exception functions as a warning, that a site may be suspect. Great!
Pkshadow 1072 solutions 14836 answers

But your still left with the problem for those 2 spots in the tiles . Try the reinstall, also can make a new Profile and Test. https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles

But your still left with the problem for those 2 spots in the tiles . Try the reinstall, also can make a new Profile and Test. https://support.mozilla.org/en-US/kb/profile-manager-create-and-remove-firefox-profiles

Chosen Solution

I understand what you are saying.

The thing is; we are testing a problem with the current config. ... and the results make sense.

If a bad tile (site link) appears in the tile space - the 'software exception' alarm rings.

Don't think that I've dumped this issue. I'm still gathering information.

I loaded another site ... it's tile appeared, and it too set off the alarm.

What were the shared elements of each bad tile?

Disqus comment system.

This is 'page related' forum software. The page topic forms the thread.

One joins the service, and can then comment on any web page that is using Disqus (you write your thoughts, and they are stored centrally).

How they earn their money, is presumably what is causing a problem.

I'm not an expert, but perhaps privacy badger, or ublock origin is interrupting connections.

Maybe it is the Firefox setup.

... but what I know is that the 3 sites using Disqus, when appearing as tiles, caused the software exception.

We are not experiencing a software glitch. This is a reaction to a repeatable event, with a common denominator.

If every tile created this problem, then sure, it would be a re-install. However, it is only specific sites.

The correct action would be to understand, what is the software exception? What action is triggering the alert.

The problem is that we are now beginning to tread on toes. Perhaps we just leave it at that.

Additional testing with other Disqus sites, is possible, but I have no doubt that the result will be the same.

We've learned something.

Time to move on methinks :)

I understand what you are saying. The thing is; we are testing a problem with the current config. ... and the results make sense. If a bad tile (site link) appears in the tile space - the 'software exception' alarm rings. Don't think that I've dumped this issue. I'm still gathering information. I loaded another site ... it's tile appeared, and it too set off the alarm. What were the shared elements of each bad tile? Disqus comment system. This is 'page related' forum software. The page topic forms the thread. One joins the service, and can then comment on any web page that is using Disqus (you write your thoughts, and they are stored centrally). How they earn their money, is presumably what is causing a problem. I'm not an expert, but perhaps privacy badger, or ublock origin is interrupting connections. Maybe it is the Firefox setup. ... but what I know is that the 3 sites using Disqus, when appearing as tiles, caused the software exception. We are not experiencing a software glitch. This is a reaction to a repeatable event, with a common denominator. If every tile created this problem, then sure, it would be a re-install. However, it is only specific sites. The correct action would be to understand, what is the software exception? What action is triggering the alert. The problem is that we are now beginning to tread on toes. Perhaps we just leave it at that. Additional testing with other Disqus sites, is possible, but I have no doubt that the result will be the same. We've learned something. Time to move on methinks :)