I was updating Mozilla Thunderbird, the free email program, and noticed an unwanted internet connection.


Anything suspicious with the word “shell” in it makes me think of hackers getting into the root or superuser account of our computers.  It is worth investigating.

I was uprgrading to Thunderbird version 3.0.11 when I saw this connection.

Another online post documents a similar issue with a Thunderbird error:

you have attempted to connect to nic-nac-project.org… but security certificate belongs to “freeshell.de”

An answer to that post said to look at the installed extensions on Thunderbird.

Look at Thunderbird Extensions

I don’t like this connection to freeshell.de and it should not be happening.  I think this code got into my installation when I downloaded an extension over a year ago to help me transfer my emails from Windows Mail to Mozilla’s Thunderbird.  This is not cool that this much time after the email transfer was complete, the code would still be connecting to freeshell.de.  And I don’t know for sure that’s why the connection happened in the first place.  I hope it’s not more sinister than this.

I looked in my Thunderbird extensions and uninstalled that lone script that I had used to transfer the emails.  While I was at it, I looked at Thunderbird’s add-ons and disabled the “Google Update”.  It seems that every time I am looking at my Mozilla settings, including Firefox, I’m finding something about Google updates.  I wish Google and Mozilla would opt-out by default.


If you see an unwanted connection to freeshell.de (or any other site), uninstall extensions you no longer use.

One Comment

  1. Heinrich says:

    You probably have an extension from https://freeshell.de/~kaosmos/index-en.html installed.

Leave a Reply