maudlin

Thanks so much! I really appreciate all the help you've provided. I installed the Block Site extension a while ago but found it to be pretty buggy, so I disabled it. Checking my FF, I can see that Mozilla added it to their blocked list just last week. I'll uninstall it now. One remaining issue: It was the duplicate malicious site notification in Thunderbird that first aroused my suspicions that something had gotten through my defenses because the IP address identified in each alert was different. 1 - Should I be suspicious if I see duplicate notifications across Mozilla apps again? (This is actually the second time this has happened over the past week.) 2 - Are duplicate notifications (with or without consistent IP addresses) a known design issue or bug? (If this isn't the right thread for these questions, please let me know what other part of the forum I should go to.)

Cleaned up copy of FRST.txt (as FRST-edit.txt). FRST-edit.txt

Sorry! I've run FRST again as admin. Here are the files. FRST.txt Addition.txt

[deleted]

Thanks for the detailed response! To clarify, the display of notifications is not an ongoing problem. After launching, closing and re-launching Thunderbird, the alert went away. The alert also went away in Firefox after showing up just once. So I won't be turning off notifications at all as I really prefer to browse with them on. But I have run the FRST scans and they are attached. FRST.txt Addition.txt

My laptop is running Windows 8.1 and I have Malwarebytes Anti-Malware Home Premium installed. I clicked a Google search result yesterday in Firefox and got this alert: Malicious Website Blocked Domain: www.hitcpm.com IP: 198.134.112.242 Type: Outbound Process: C:\Program Files (x86)\Mozilla Firefox\firefox.exe I backed out of Google and believed that between the app and NoScript, I wasn't affected by whatever was on the dodgy site. I ran a full scan just to be sure in MWB and nothing showed up, which is what I expected. But when I switched back to Thunderbird, an almost identical alert showed again. Malicious Website Blocked Domain: www.hitcpm.com IP: 198.134.112.244 <== Note different IP Type: Outbound Process: C:\Program Files (x86)\Mozilla Thunderbird/thunderbird.exe I ran the scan again and still nothing. I also ran a full scan with Windows Defender and everything was clean. My questions: 1) If the software successfully blocked the malicious site in Firefox, why did I get a slightly different alert, with a different IP address, in Thunderbord? Are there some shared processes between Mozilla apps? Please note that every time I boot Firefox, I get a brief alert that "Mozilla Firefox (and add-ons) is now protected by Malware Anti-Exploit Beta". I never get this alert when launching Thunderbird. 2) Are there any additional steps I should take now?