Firefox 3 Beta 4 (build 200804816) - CPU Rampage

[kalman]

Since the last update the usage of that browser has become impossible.
It takes lot of CPU power and the HD activity is very high.

[kuby]

Re: Firefox 3 Beta 4 (build 200804816) - CPU Rampage

First suggestion is to upgrade to beta 5, which is in the repositories

[kalman]

Re: Firefox 3 Beta 4 (build 200804816) - CPU Rampage

First suggestion is to upgrade to beta 5, which is in the repositories

I do have Pre-release updates, Unsupported updates enabled but I still don't see the beta5

[kuby]

Re: Firefox 3 Beta 4 (build 200804816) - CPU Rampage

Sorry, my mistake. I didn't realize you were on 7.10 (stupid me). For 7.10 beta 4 is latest according to: http://packages.ubuntu.com/gutsy-backports/firefox-3.0

[Guest]

Re: Firefox 3 Beta 4 (build 200804816) - CPU Rampage

Same problem here with Mozilla Firefox 3 Beta 5 on Kubuntu 8.04:

It must be a security issue: executing

$ netstat -t
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address      Foreign Address     State
tcp    0   0 papagolf.local:60871  a213-22-51-157.cp:43003 ESTABLISHED
tcp    0   0 papagolf.local:39828  tamerlane.rivy.or:imaps ESTABLISHED
tcp    0   0 papagolf.local:33507  starfury.doreo.com:www ESTABLISHED
tcp    0   0 papagolf.local:40576  216.148.213.145:pop3  TIME_WAIT
tcp    0   0 papagolf.local:33505  starfury.doreo.com:www ESTABLISHED
tcp    0   0 papagolf.local:33509  starfury.doreo.com:www ESTABLISHED
tcp    0   0 papagolf.local:33760  74.125.10.17:www    ESTABLISHED
tcp    0   0 papagolf.local:50598  nf-in-f104.google.c:www ESTABLISHED
tcp    0   0 papagolf.local:33506  starfury.doreo.com:www ESTABLISHED
tcp    0   0 papagolf.local:33510  starfury.doreo.com:www ESTABLISHED
tcp    0   0 papagolf.local:39829  tamerlane.rivy.or:imaps ESTABLISHED
tcp    0   0 papagolf.local:33508  starfury.doreo.com:www ESTABLISHED

I see that someone is connected to my host on port 43003, and loading my connection heavily with requests to the www, because I didn't connect to that website starfury.doreo.com that appears into the list. When I run:

$ netstat -t -n
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address      Foreign Address     State
tcp    0   0 192.168.1.100:60871   213.22.51.157:43003   ESTABLISHED
tcp    0   0 192.168.1.100:39828   85.10.196.184:993    ESTABLISHED
tcp    0   0 192.168.1.100:39829   85.10.196.184:993    ESTABLISHED
tcp    1   0 192.168.1.100:42648   64.233.183.101:80    CLOSE_WAIT
tcp    0   0 192.168.1.100:44590   194.150.224.32:110   TIME_WAIT

I can see the IP address 213.22.51.157 of someone from Portugal, as it appears from next command:

$ dig +short -x 213.22.51.157
a213-22-51-157.cpe.netcabo.pt.

Anyway, the problem disappeared when I blocked the access to my host to all the packets coming from that IP:

sudo iptables --append INPUT -s 213.22.51.157 -j DROP

The good news is that I blocked the attacker; the bad news is that I probably installed some malware as an extension of Firefox.

Hoping this helps.

[Fintan]

Re: Firefox 3 Beta 4 (build 200804816) - CPU Rampage

Yes, FF3.0b4 had a few issues that were resolved in b5. My FF3.0b5 uses soemthing like
6.3%mem and 3.6%cpu according to

top

with five or six tabs open and youtube playing.