Freeshell.de

Anything suspicious with the word “shell” in it makes me think of hackers getting into the root or superuser account of our computers.  It is worth investigating.

I was uprgrading to Thunderbird version 3.0.11 when I saw this connection.

Another online post documents a similar issue with a Thunderbird error:

you have attempted to connect to nic-nac-project.org… but security certificate belongs to “freeshell.de”

An answer to that post said to look at the installed extensions on Thunderbird.

Look at Thunderbird Extensions

I don’t like this connection to freeshell.de and it should not be happening.  I think this code got into my installation when I downloaded an extension over a year ago to help me transfer my emails from Windows Mail to Mozilla’s Thunderbird.  This is not cool that this much time after the email transfer was complete, the code would still be connecting to freeshell.de.  And I don’t know for sure that’s why the connection happened in the first place.  I hope it’s not more sinister than this.

I looked in my Thunderbird extensions and uninstalled that lone script that I had used to transfer the emails.  While I was at it, I looked at Thunderbird’s add-ons and disabled the “Google Update”.  It seems that every time I am looking at my Mozilla settings, including Firefox, I’m finding something about Google updates.  I wish Google and Mozilla would opt-out by default.

Conclusion

If you see an unwanted connection to freeshell.de (or any other site), uninstall extensions you no longer use.

I’ve been watching the packets of data fly in and out of my computer’s network card and I’m surprised how much unsolicited traffic there is.  From my observation, the biggest consumer of those packets is Google.

Here are some things you can do to keep Firefox from sending too much information to Google.  Break the tie between Firefox and Google.

1.  Unblock “attack sites” and “forgeries”. Where does this list of blocked sites automatically come from?  Google!  I wasn’t aware until today that Firefox was so cozy with Google.  It’s like Firefox comes bundled with Google now.  Firefox sends data to Google with most of us not realizing it.  I thought Firefox was independent from corporations, but guess I was wrong.  It’s integrated with one of the world’s most powerful companies:  Google.  [I learned about this issue from here:  source.]

One choice we can make is to uncheck the two boxes shown below.

• Block reported attack sites
• Block reported web forgeries

In Firefox, go to Tools >> Options >> Security

Some people have reported problems with slow-downs and crashes when these are options are checked, so it might even be a performance enhancer to uncheck them.  Source:  ubuntuforums.org.

Disadvantages to Blocking Sites

One question I have about this black list of “attack sites” is: How is this determined?  Who gets to decide which sites go on that list of blocked sites?  May I take a peek at this list?  Is it open and transparent?  How do I know that my websites are not on that list?  I see a danger with such a list.

If a website has content that someone wants censored, they might put that site on the black list.  Then, any time someone attempts to visit the site, they get creeped out when they see a message telling them it is a reported “attack site”.  Maybe there are terrorists in that site!!

If people always believe that, then the content never gets viewed and people leave it alone.  Seems like a way to censor the internet.  The information is there for anyone to view, but since the site is reported to be an “attack site”, no one has the balls enough to go in and look at it.

Permanent Google Cookie

Did you know that Firefox is bundled with a permanent cookie, hard-wired in, that you cannot delete, change or remove?  This cookie is sent to Google automatically and frequently throughout the day.  I believe that Google justifies this by saying they are giving you updates to the blocked list.   The cookie is always the same.  (You can see how this cookie is sent to Google using a packet sniffer program, like SmartSniff.)  Google always knows your IP address and who knows what else they have.  One way I found to change the cookie:

2.  Reinstall Firefox.

I uninstalled Firefox, downloaded a fresh copy, and reinstalled it.  Luckily, all of Firefox’s settings are saved in a separate folder and do not get destroyed during this process, so I still have all my bookmarks and add-ons working just like before the reinstallation.  But now I have a new cookie that is being sent to Google.

OK, back to breaking the tie between Firefox and Google…

3.  Use Adblock Plus. See my previous post about this Firefox add-on.

4.  For additional privacy, turn off the referrer. This means when you go to a Google site (or any other site), it’s harder for them to know where you came from or what site you were at previously.

To do this, in the Firefox address bar, type in about:config.

Type this into the filter:  network.http.sendRefererHeader

Double-click on the value (2 in the screenshot above).  A window will pop up.  Change the value to 0.

You could always go back any time and change it back to the default “2″ if you want.

Similarly, you could also set network.prefetch-next to false, which is what I did.  Advantages to this are explained at:  ubuntuforums.org.

~

I’m still not done.  My computer is still connecting to Google without my consent, but now there is less of it and it’s less frequent.

Above, Currports tells us that we are connecting to not only Google’s servers, but Facebook’s servers as well.  (1e100.net is one of Google’s servers.)  We can block both of them and more.

How to Block Google Analytics, Google ads, Facebook, etc…

• Use Firefox
• Install the add-on:  Adblock Plus.  The short video below shows how easy this is to do.

• The Adblock icon should appear on the top, right corner of your Firefox browser.

If you click on the icon, you will see a list of URL’s you can block specific to the current web page you are visiting.  This is a powerful tool that can be used to block all kinds of sites besides Google, including:

Facebook

Yahoo

MSN

doubleclick.net

For example, at the Truveo website, they try to get your computer to connect to Facebook servers and Google servers, among many servers.

Adblock Plus is blocking Facebook and Google Analytics on my computer.

If you see an address you don’t want your computer connecting to, double-click on it.  A new window will open.

Select a radio button, or accept the one already selected.  Then press “Add filter”.

Your browser will no longer connect to the websites or servers that you select.  These settings are saved and will be remembered every time you browse the web.

–

Currports may be downloaded for free at nirsoft.net

Go to Start >> type in a search of “firewall”

Choose Windows Firewall with Advanced Security.

Click on Outbound Rules.

Actions >> New Rule  >> Program >> Next >>

This Program Path:  C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

>> Next >> Block the connection >> Next >> Next >>

Give this firewall entry a personal note so you remember what it is if you ever come across it in the future.  Press Finish.  Google is now blocked from running its “updater” code and connecting my computer to the internet without my consent.

Google has installed its code in many places on my computer and I don’t want it.  I just found more Google code as a Firefox add-on, calling itself “Google Updater”.  I don’t want an updater for Google so I am removing this.  Here’s how:

Open Firefox.

Tools >> Add-ons

1.  Click on the Plug-ins tab.

2.  Click on the Disable button next to Google Update.

Related Posts
Why is GoogleToolbarNotifier.exe on my computer?

If you want to see what Google is doing on your computer, and if you are running Vista…

Go to Start >> Type into your search box “task scheduler” and run that program.

Disable Google Updater

In Task Scheduler, I disabled all the Google Updater programs once I realized they were there.

To do this, click on “Task Scheduler Library” to display the tasks.  Then, click on the GoogleUpdateTaskMachine entries and click Disable.  This should stop the Google tasks from running automatically.

Related Posts:

Block Google Updater with Vista’s Firewall

Uninstall Google Add-on from Firefox

Why is GoogleToolbarNotifier.exe on my computer?

I have been watching my computer lately to see what it’s doing on the internet.  I want to make sure I haven’t been hacked.  I’m surprised how many different IP addresses my computer connects to without my consent.  GoogleToolbarNotifier.exe is one of them.

Using TCPView, a free program by Microsoft, I watched what internet connections were made when I opened my Firefox browser.  As far as I know, I have no other applications open that should be connecting to the internet.  So, just now as a test, I go to the Cuil search engine.   And to my surprise, I see that my computer connects to a Google server and a Facebook server!

Google server:  74.125.0.148

Facebook server:  www-12-02.snc4.facebook.com

I see the Cuil website has a big link on the top of the page for Facebook, so that explains why my computer is connecting to Facebook, probably running a little Facebook code through Cuil’s home page.

I did not want to connect to Google or to Facebook, so this irriates me that my machine is connecting to the web like this.  So what about this Google server?  What information is my computer sending to Google?  Keep in mind, I did not go Google’s website… I went to Cuil’s website.

Looking at the running processes on my machine, I see GoogleToolbarNotifier.exe is always running. And why is that?

“GoogleToolbarNotifier.exe is a background process…” “…used to notify you when some program is attempting to change IE default search engine to those other than Google.”  source

I’m going to remove the Google Toolbar Notifier.  I don’t need a program running on my computer and connecting to the internet all the time to keep track of which search engine I’m using.  Sounds absurd, really, to think people need help keeping their search engine to one source.  If I want Google, I’ll be sure to use Google.  But I enjoy searching the web from many different perspectives.  There are so many search engines.  Today I’m using Cuil but I switch around all the time.

One comment on ready2beat.com claims that the Google Toolbar Notifier “sends user entered Keywords and Phrases to Google”.  Does my computer send my keywords even if I am not using the Google search engine?  Oh, by the way… I don’t remember installing the Google Toolbar and don’t want it.  So why is it on my computer?  Maybe my wife let it get installed…. sometimes these toolbars are bundled with other programs, like games for the kids, and Java updates.

How I removed GoogleToolbarNotifier.exe

Open up IE.

1.  Click on Tools >> Internet Options

2.  Click on the Programs tab.

3.  Manage add-ons.

4.  Disable.

While I was at it, I disabled all the other stuff, too, just to see if I notice any differences.  I don’t use IE much, anyway.  I primarily use Firefox.

OK, now it’s disabled in the IE browser.  Now it’s time to uninstall it.  However, when I went to the control panel to uninstall it, Google Toolbar is not shown.  Hmm, it appears I can’t uninstall it like a normal program.

These are the programs installed on my machine with the word “Google” in them:

Google Earth, Google Updater, and Google Sketchup

I chose to uninstall Google Updater.  Now GoogleToolbarNotifier.exe is not showing up as a running process connected to the internet.

Conclusion

If I had to repeat this process, and what I would recommend to you, is first try to go to the Control Panel and uninstall Google Updater.  It might not be necessary to remove it from IE… I’m not sure.  Let me know if you find out.   Give us a comment below.  Following the steps above did stop GoogleToolbarNotifier.exe from making an unwanted internet connection from my computer.

Related posts:

Uninstall Google Add-on from Firefox

Google is Clogging Up My Task Scheduler

What is IP 198.63.194.98? (Sun’s Java Automatic Updater)