Temp file trying to access internet on FF launch

[Hagu13]

Like it says on the title- when Firefox is open- sometimes within a minute or 2, sometimes much later, a temp file in C:\users\Myname\appdata\local\temp tries to access the internet. Filename is iju(random 4 character alpanumeric string).tmp. Type is image line bvba. A new file is created every time.

Googling "image line bvba" gets me to a legitimate seeming audio app by this name, and the popup box from Windows Firewall includes the logo of this company on the popup box. But I have never installed this software and cannot find any reference to it being malicious, or having been spoofed. I have searched the computer and autostarts for any files that contain "image" "bvba" "il" "iju" and found nothing. Nothing shows up in installed programs either.

Virus and spyware scans come up clean. Uninstalled FF, deleted directory, cleaned registry, no change.
Win 7, Avast AV, Windows FW, all updated

Please help.

 

[AndyCT]

Do you have Java installed? When I opened IE I had unwanted pop-ups and I suspected my older version of Java was the culprit (or the door to the spammer targeting my computer). I uninstalled Java and the problem stopped.

 

[AndyCT]

You should also check what Active X controls and plugins are loaded when FF starts.

 

[Hagu13]

Thanks for the suggestions

I have Java- but only to allow FF to display certain sites properly. Will uninstall everything java and let FF pull in what it needs when next needed.

Plugins- Almost nothing, and everything I am using I have used for over a year with no issues, and use on all my machines (XP/Vista/7) with no issues. I'm now running FF4 beta and most plugins don't work on it yet anyway, but the problem persists.

THanks, keep the suggestions coming
Hagu

 

[Hagu13]

More....Have also noticed that sometimes it launches IE at the same time this temp file tries its luck. I have IE installed (8 I think) but I NEVER use it. Usually however, IE doesn't launch

 

[gregmcc]

Grab the file and upload it to virustotal to be 100% sure.

 

[murraybiscuit]

do you have symantec endpoint protection installed?
read a thread where similar thing was happening (different file names though)
turned out to be a bug with the AV.