Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Lolu chungechunge lwabekwa kunqolobane. Uyacelwa ubuze umbuzo omusha uma udinga usizo.

Connections to certain IPs remain active despite clearing history, using private browsing, exiting browser

more options

Hello,

I've noticed that, despite me clearing all history, using private browsing, or properly exiting Firefox, an outbound connection to certain IP addresses remains active, like I said, even after exiting the browser. I am able to view these via the Network Monitor that's a part of Kaspersky Internet Security. The only way I can get those connections to stop is by rebooting my computer.

The IPs I've noticed that exhibit this behavior belong to Google, Yahoo, and Twitter.

How can I get this to stop?

Thanks for your time. Best regards.

Hello, I've noticed that, despite me clearing all history, using private browsing, or properly exiting Firefox, an outbound connection to certain IP addresses remains active, like I said, even after exiting the browser. I am able to view these via the Network Monitor that's a part of Kaspersky Internet Security. The only way I can get those connections to stop is by rebooting my computer. The IPs I've noticed that exhibit this behavior belong to Google, Yahoo, and Twitter. How can I get this to stop? Thanks for your time. Best regards.

All Replies (2)

more options

Adding more information:

I found this thread https://support.mozilla.org/en-US/questions/1142347 and, given that the domains those IPs I'm referring to are involved in tracking (another one I found, after I made this post, was Facebook, which I picked up by just visiting a different site where someone was linking to their FB page), I thought my problem could have the same root cause as this person's.

I installed the BetterPrivacy addon suggested there, and, sadly, nothing improved. I still have network activity showing from these IPs. See "network monitor.jpg" (edit: the first screencap, since file names seem to change with upload) - the 199 IP belongs to Twitter (never even logged on, just visited the site to pick it up and test it), and the 192.0.77.2 is one I picked up by visiting this forum; it apparently belongs to "Automattic." In the screencap, the highlighted session is the one I just closed. All FF sessions are closed, but that's the one that took place after I installed BetterPrivacy. However, since installing this plugin, FF has been using more computer resources, and this is something I definitely want to avoid, due to an unrelated issue I'm having with hardware and resource consumption. (So, the plugin sounds great, but, given my situation, if it's not going to help in my case, I'd rather remove it. :( What do you think?)

My Macromedia Player Settings show no sites, despite the Kaspersky Monitor saying there are active connections at the time. Please see "macromedia player settings.jpg" / the second screencap.

Anyway, I'm just assuming these are trackers, based on the domains they come from, and if that's the case, I don't know how I'm picking them up, because I shouldn't be, and, more importantly, I don't know how to get rid of them. :(

Please help! Thanks in advance!

Okulungisiwe ngu bna1

more options

It's hard to explain why Firefox would have outbound connections after it has exited. Could you double-check on the Windows Task Manager (Ctrl+Shift+Esc) Processes tab that all instances of firefox.exe and plugin-container.exe have disappeared?


In your firewall, is it possible to remove authorization for all executables currently considered to be "Firefox" and only re-establish them by running Firefox and allowing them as you go when you can confirm they are really Firefox?


I'm not certain from your screenshot whether you are proxying through Kaspersky. This is part of the filtering feature whose name I'm forgetting: Firefox sends a request to, say, Google, which is intercepted by Kaspersky. Kaspersky replies as Google and forms a secure connection with Firefox, while Kaspersky makes a secure connection with Google. In this "man in the middle" arrangement, unless Firefox tries to connect on a port that Kaspersky is not intercepting, Firefox never actually makes a direct connection to Google.


I don't think Flash LSO's are related to connections being left open. As you demonstrated by noting that none exist while this problem continues. You can remove BetterPrivacy or keep it disabled for now.


See "network monitor.jpg" (edit: the first screencap, since file names seem to change with upload) - the 199 IP belongs to Twitter (never even logged on, just visited the site to pick it up and test it), and the 192.0.77.2 is one I picked up by visiting this forum; it apparently belongs to "Automattic."

The "avatars" (user images) on this site are stored by Gravatar, which was acquired by Automattic, the company behind WordPress.com (the commercial side of WordPress). So that connection doesn't surprise me. But it would be weird if it stayed open after Firefox completes its shutdown, or even if you left all sites that use Gravatar and actively used Firefox for other things, since Windows doesn't allow an indefinite pool of connections to be left open.