Type about:config on the browser, type in the "filter" box
Set the switches that say enabled to fakse. And the .remotelookups to false. And you can setup the urls to be empty in the safebrowsing section.
Go to tools->options->addons click plugins disable the google update plugin if it's there.
Go to tools->options->security Clear the block reported checkboxes
There is a network monitor also search for sysinternals, run it check what connections the browser does (check the 1e100.net packets). You may have to restart the browser and/or make sure you kill the process FF runs.
It is not an extension it's something built-in, I don't know at which version of FF exactly they started doing it, but I remember seeing those connections in the past and started searching to find out what you said originally.