mozilla firefox browser always opens on startup

Of course, any executable file whose origin/authenticity is uncertain could be a culprit. It seems that many of the Firefox users affected by the symptoms admit to playing other online multiplayer games - giving some credence to the idea that infected game hacks(cheats) is a more frequent source of infection. While SpySweeper suggests that the Poison Ivy trojan is normally spread via email attachment, one of the first reports of PoisonIvy.20.A detection was an infected Runescape (online multiplayer game) hack posted on a gaming message board, and shortly afterwards a similarly posted Diablo II hack was also found infected with the same. It should also be noted that the Poison Ivy utility is under ongoing development and the server files can be remotely updated by the hacker as needed - which may further complicate detection. Some users have reported the symptoms and then successful detection of malware of various names - but it is hard to say whether these are identical culprits as competing a/v companies often give the same trojan differing names, or just give them a generic name with little or no supporting info. The Webroot SpySweeper site now lists Poison Ivy, flagged with Severity: CRITICAL and the BitDefender site now lists with one of the symptoms being, An instance of Firefox running in background even after Firefox is closed.

The first reported successful detection of an 'ivy'-related trojan (in the context of the Firefox-related symptoms, listed below) appears to have been with 'NOD32 Antivirus' ($), and not long after, it seems 'Avira AntiVir' (free) added Poisonivy.20.A to their definition file. This may explain why many of the popular spyware & antivirus utilities - and even the usual rootkit detectors - fail to detect anything malicious on affected systems. Another handy feature is the 'Melt' function - which deletes the original infected file upon first run, so that a user cannot inspect it or uploaded to an anti-virus company's database. One such feature was the apparently unique 'Persistence' option - if enabled, the server file located on the infected system will restart itself even when the process is manually killed by the user - which means more 'up time' for the hacker - no waiting for the infected user to reboot their system or manually restart an affected application. While there are other similar Remote-Admin apps used by trojan-makers, Poison Ivy quickly became popular for a number of reasons - it was new, it could be deployed without arousing much suspicion, it injected itself into the Default Browser process, and it had an attractive range of monitoring & set-up features.

So while many Firefox users naturally assumed the problems they were experiencing were a 'Firefox problem', they would in fact have happened whichever browser was set as their system Default. The default settings is for the malicious 'server' file to inject itself into the target system's Default Browser memory space and then run as a phony 'duplicate' browser process, which enables it to bypass detection by firewalls and routers. The trojan creates a 'server' file on the affected system which alerts the trojan-maker when an affected system is online and which then gives access to, monitoring of, and even complete control of an infected user's system - giving him (among other things) the possibility to steal usernames & passwords, banking or credit card info, or any other private information that may have been stored, typed or viewed on-screen while the computer is infected. Since June of 2006, numerous users have reported experiencing similar issues with their browser which were later found attributable to a malicious trojan - specifically one based on Poison Ivy, an advanced 'reverse connection', firewall-bypassing remote administration tool.

Mozilla firefox browser always opens on startup