X
Tap here to go to the mobile version of the site.

Support Forum

Flash Player Plugin tries to access the internet upon arriving at account login pages

Posted

Firefox 24.0 Adobe Flash Player Plugin 11.8 r800 Firewall software: ZoneAlarm

My firewall is set to "Manual Control" and I get warnings for all Internet access attempts. Firefox is already granted outgoing access to the Internet, so I surf without additional warnings. So if I go to YouTube, I can watch the videos without receiving a prompt from my Firewall.

However when I visit a secure account login page (where I have to enter my user ID and PW) the Firewall warns me that "Firefox is trying to use Adobe Flash Player 11.8 r800 to access the Internet".

A prompt like this is provided by the Firewall when one program uses another to access the Internet. If for example I click on a link in MS Excel, the firewall will tell me that Excel is trying to use Firefox to access the Internet.

What makes me concerned is: 1) Firefox already has access privileges. It should not need to "use Flash to access the internet" 2) This occurs when I'm about to use the keyboard to enter sensitive data into a secure page 3) There are no [apparent] Flash elements on the login pages.

Could I have acquired a malicious Flash software that tries to collect keystrokes and transmit them somewhere? Is there a way to show (in Firefox) which Flash file is working at any given time? (This would let me identify what's making the attempt to access)

I am fully protected with Antivirus, Antispam, and breach prevention software. I also ran Norton Power Eraser to see if there was anything at Root level. Nothing found.

Thank you, in advance for your feedback.

Firefox 24.0 Adobe Flash Player Plugin 11.8 r800 Firewall software: ZoneAlarm My firewall is set to "Manual Control" and I get warnings for all Internet access attempts. Firefox is already granted outgoing access to the Internet, so I surf without additional warnings. So if I go to YouTube, I can watch the videos without receiving a prompt from my Firewall. However when I visit a secure account login page (where I have to enter my user ID and PW) the Firewall warns me that "Firefox is trying to use Adobe Flash Player 11.8 r800 to access the Internet". A prompt like this is provided by the Firewall when one program uses another to access the Internet. If for example I click on a link in MS Excel, the firewall will tell me that Excel is trying to use Firefox to access the Internet. What makes me concerned is: 1) Firefox already has access privileges. It should not need to "use Flash to access the internet" 2) This occurs when I'm about to use the keyboard to enter sensitive data into a secure page 3) There are no [apparent] Flash elements on the login pages. Could I have acquired a malicious Flash software that tries to collect keystrokes and transmit them somewhere? Is there a way to show (in Firefox) which Flash file is working at any given time? (This would let me identify what's making the attempt to access) I am fully protected with Antivirus, Antispam, and breach prevention software. I also ran Norton Power Eraser to see if there was anything at Root level. Nothing found. Thank you, in advance for your feedback.

Chosen solution

Pages can use Flash even when there is no video displayed. For example some sites use Flash for menus, some for audio, and some may load Flash in their Google Analytics scripts so they know as much as possible about your system.

In most cases, the Flash player will be trying to load a .SWF file, although that may not always be obvious. You could look for it in Firefox's Web Console.

While viewing the page, press Ctrl+Shift+k, the reload the page. If there is a request for Flash media from the page, it should appear in the console (if the request is held up by your firewall, it nevertheless should appear as a pending request). There is a search/filter box where you could try entering .swf to reduce the time needed to scan through the list. Can you find the URL of the requested file? That might or might not make you comfortable about the request.

Read this answer in context 9

Additional System Details

Installed Plug-ins

  • Shockwave Flash 11.8 r800
  • Next Generation Java Plug-in 10.25.2 for Mozilla browsers
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Citrix Online App Detector Plugin
  • Adobe Shockwave for Director Netscape plug-in, version 12.0.3.133
  • 5.1.20513.0
  • Adobe PDF Plug-In For Firefox and Netscape 11.0.03
  • A plugin to detect whether the Adobe Extension Manager is installed on this machine.
  • Adobe PDF Plug-In For Firefox and Netscape 11.0.02
  • Shockwave Flash 9.0 r45

Application

  • Firefox 24.0
  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0
  • Support URL: https://support.mozilla.org/1/firefox/24.0/WINNT/en-US/

Extensions

  • Adobe Acrobat - Create PDF 2.0 (web2pdfextension@web2pdf.adobedotcom)
  • Troubleshooter 1.1a (troubleshooter@mozilla.org)

Javascript

  • incrementalGCEnabled: True

Graphics

  • adapterDescription: ATI Mobility Radeon HD 4670
  • adapterDescription2:
  • adapterDeviceID: 0x9488
  • adapterDeviceID2:
  • adapterDrivers: aticfx64 aticfx64 aticfx32 aticfx32 atiumd64 atidxx64 atiumdag atidxx32 atiumdva atiumd6a atitmm64
  • adapterDrivers2:
  • adapterRAM: 1024
  • adapterRAM2:
  • adapterVendorID: 0x1002
  • adapterVendorID2:
  • direct2DEnabled: True
  • directWriteEnabled: True
  • directWriteVersion: 6.2.9200.16571
  • driverDate: 12-5-2011
  • driverDate2:
  • driverVersion: 8.930.0.0
  • driverVersion2:
  • info: {u'AzureCanvasBackend': u'direct2d', u'AzureFallbackCanvasBackend': u'cairo', u'AzureContentBackend': u'direct2d'}
  • isGPU2Active: False
  • numAcceleratedWindows: 1
  • numTotalWindows: 1
  • webglRenderer: Google Inc. -- ANGLE (ATI Mobility Radeon HD 4670 Direct3D9Ex vs_3_0 ps_3_0)
  • windowLayerManagerRemote: False
  • windowLayerManagerType: Direct3D 10

Modified Preferences

  • accessibility.typeaheadfind.flashBar: 0
  • browser.cache.disk.capacity: 358400
  • browser.cache.disk.smart_size.first_run: False
  • browser.cache.disk.smart_size.use_old_max: False
  • browser.cache.disk.smart_size_cached_value: 358400
  • browser.places.smartBookmarksVersion: 4
  • browser.search.useDBForOrder: True
  • browser.sessionstore.restore_on_demand: False
  • browser.startup.homepage: about:blank
  • browser.startup.homepage_override.buildID: 20130910160258
  • browser.startup.homepage_override.mstone: 24.0
  • browser.urlbar.default.behavior: 1
  • dom.mozApps.used: True
  • extensions.lastAppVersion: 24.0
  • font.internaluseonly.changed: False
  • font.name.serif.x-western: Arial
  • font.size.variable.x-western: 14
  • gfx.direct3d.last_used_feature_level_idx: 0
  • network.cookie.cookieBehavior: 3
  • network.cookie.lifetimePolicy: 2
  • network.cookie.prefsMigrated: True
  • network.protocol-handler.expose.mailto: True
  • network.protocol-handler.external.mailto: False
  • places.database.lastMaintenance: 1381159767
  • places.history.expiration.transient_current_max_pages: 104858
  • plugin.disable_full_page_plugin_for_types: application/pdf,audio/3gpp,video/3gpp,audio/basic,audio/AMR,application/x-mpeg,audio/x-aiff,audio/aiff,audio/x-aac,audio/aac,application/vnd.adobe.xdp+xml,application/vnd.fdf,application/vnd.adobe.xfdf,audio/x-ac3,video/3gpp2,audio/3gpp2,audio/wav,audio/x-wav,audio/mid,audio/midi,audio/x-midi,video/mpeg,video/x-mpeg,video/mp4,video/x-m4v,audio/mpeg,audio/x-mpeg,audio/mp4,audio/x-m4a,image/png,image/x-png
  • plugin.importedState: True
  • plugin.state.flash: 2
  • plugin.state.npamazonmp3downloaderplugin: 0
  • plugin.state.npatgpc: 0
  • plugin.state.npdeployjava: 2
  • plugin.state.npffapi: 0
  • plugin.state.npgoogletalk: 0
  • plugin.state.npgoogleupdate: 0
  • plugin.state.npgtpo3dautoplugin: 0
  • plugin.state.npo1d: 0
  • plugin.state.nppdf: 2
  • privacy.clearOnShutdown.formdata: False
  • privacy.clearOnShutdown.offlineApps: True
  • privacy.cpd.offlineApps: True
  • privacy.sanitize.migrateFx3Prefs: True
  • privacy.sanitize.sanitizeOnShutdown: True
  • privacy.sanitize.timeSpan: 0
  • security.warn_viewing_mixed: False
  • storage.vacuum.last.index: 1
  • storage.vacuum.last.places.sqlite: 1380492505

Misc

  • User JS: Yes
  • Accessibility: No
jscher2000
  • Top 10 Contributor
3124 solutions 28732 answers

Chosen Solution

Pages can use Flash even when there is no video displayed. For example some sites use Flash for menus, some for audio, and some may load Flash in their Google Analytics scripts so they know as much as possible about your system.

In most cases, the Flash player will be trying to load a .SWF file, although that may not always be obvious. You could look for it in Firefox's Web Console.

While viewing the page, press Ctrl+Shift+k, the reload the page. If there is a request for Flash media from the page, it should appear in the console (if the request is held up by your firewall, it nevertheless should appear as a pending request). There is a search/filter box where you could try entering .swf to reduce the time needed to scan through the list. Can you find the URL of the requested file? That might or might not make you comfortable about the request.

Pages can use Flash even when there is no video displayed. For example some sites use Flash for menus, some for audio, and some may load Flash in their Google Analytics scripts so they know as much as possible about your system. In most cases, the Flash player will be trying to load a .SWF file, although that may not always be obvious. You could look for it in Firefox's Web Console. While viewing the page, press Ctrl+Shift+k, the reload the page. If there is a request for Flash media from the page, it should appear in the console (if the request is held up by your firewall, it nevertheless should appear as a pending request). There is a search/filter box where you could try entering .swf to reduce the time needed to scan through the list. Can you find the URL of the requested file? That might or might not make you comfortable about the request.

Question owner

Thank you very much for your quick response Jscher!

Indeed it was a tiny SWF file, and it was loaded from the website, not from a local folder on my computer.

And yes, my Firewall does show me the IP address and Port#. Now that I know what the SWF is, the IP address makes sense.

Thanks again!

Thank you very much for your quick response Jscher! Indeed it was a tiny SWF file, and it was loaded from the website, not from a local folder on my computer. And yes, my Firewall does show me the IP address and Port#. Now that I know what the SWF is, the IP address makes sense. Thanks again!