Sounds possible malware changed the proxy setting to redirect firefox traffic to a service on local machine (to spy or inject ads or whatever).

Wonder if there's any way to find if there is such a service running?

In reply to a post by cheshire_man:

Wonder if there's any way to find if there is such a service running?

Linky

"netstat -abn" seems to be the most useful. You will need to run as administrator.

Thanks Mick

Got an interesting list, but no sign of anything using port 49164.

It may be a left-over from malware that has already been removed.

Check the hosts file for redirection.

In reply to a post by Banger:

Check the hosts file for redirection.

Good point although the hosts file is not easy to find or open in Windows 7. Instructions here. Damn Microsoft for making things unnecessarily difficult for end-users. Any competent hacker can get around their pathetic restrictions.

No Mick, it's in exactly the same place as it was in Windows XP. You're just making an anti-Windows remark with no real justification.

In reply to a post by Pipexer:

You're just making an anti-Windows remark with no real justification.

Not at all. I've never used Vista and I didn't use XP very much. All my development work was done on Windows 2000 which suited my requirements like a pair of comfy old gloves and there was no problem in tinkering with system files, even though it could be a pain in other ways. I had to upgrade eventually and moved directly to Windows 7. It was quite a shock at the time although I have come to love it. Since I now have a stable and usable software development environment, I'm not looking forward to having to upgrade again.

Edit: Actually, I don't recall having any difficulty in editing the hosts file on XP. I'm sure I must have done it since I did use it for some development work. The etc directory wasn't hidden and a user with admin privileges had write access to everything.

Edited by micksharpe (Sat 17-Jan-15 17:59:44)

How is this a Windows issue?