This thread was archived. Please ask a new question if you need help.
Firefox version 220.127.116.1197 appears in windows/erdnt/cache how do I remove it
The first scan I ran with Secunia PSI 2 flagged up an old version of Firefox 18.104.22.16897 as out of date and no longer supported and recommended updating or uninstalling. I was unaware I had any old versions of Firefox installed as I am using the latest version 36.0.4 which actually appears further down the list of programmes on the PSI scan. This old version's location is also a bit strange, it appears in a cache within a folder called erdnt in windows. The file path is .... windows\erdnt\cache\firefox.exe. I have looked online for info about this erdnt folder and it seems to be part of a backup programme called ERUNT which I do not seem to have. Very strange. The current version of Firefox 36.0.4 is located in the program files where I would expect to find it.
Can anyone shed some light on this and explain why there appears to be an old version of Firefox in this odd location and if it is OK to remove it and how I go about doing so. Do I just delete or do I need to uninstall it ? What affect any action might have on the current version of Firefox that I am using ?
All Replies (11)
That is NOT a Firefox version I ever heard of, and the Firefox programs are stored in the computers Programs Folder.
Open the folder you posted, and rename that file to fffffffffff.exe. Use most or all of the listed scanners.
Sometimes a problem with Firefox may be a result of malware installed on your computer, that you may not be aware of.
You can try these free programs to scan for malware, which work with your existing antivirus software:
- Microsoft Safety Scanner
- MalwareBytes' Anti-Malware
- Anti-Rootkit Utility - TDSSKiller
- AdwCleaner (for more info, see this alternate AdwCleaner download page)
- Hitman Pro
- ESET Online Scanner
Further information can be found in the Troubleshoot Firefox issues caused by malware article.
Did this fix your problems? Please report back to us!
The tool is known to act as a back up to the Windows Registry.
Does Erunt use a number scheme for naming its registry backups for specific programs?
removed the fake and malware tags.
That is NOT a Firefox version I ever heard of
It is the FileVersionNumber of the Firefox 33.0 .exe however.
Hi, Thanks for your replies just picked them up, a bit late in the day, and then screwed up my initial reply by attempting to quote part of Fred McD's post as above. Managed to lose the reply in the process.
I have fairly basic computer skills and am not fully versed with the Forum options or etiquette either !
So, try again, I am not sure why I need to rename the file I posted as ffffffffff.exe ( Are the number of f's important ? ) (Tried to 'quote' part of FredMcD's reply here ) . I have a McAfee security suite as well as Malwarebytes and Hitman Pro, they have not picked up any Malware. I am reluctant to use an antiRootkit programme unless really necessary as do not really have the skills to interpret any result other than clear, eg a false positive. My PC's behaviour has not given me any real concerns.
I have looked at the forums on Bleeping Computer for help and may post this question there as well. There was the odd reference but I did not really find an answer. I do not appear to have the ERUNT programme just the erdnt folder in windows with a cache folder containing the old Firefox version. I notice though that the file was created just after I switched to Firefox for the first time about six months ago.
Have just realised , having not used the forum very often, that the last two posts are 'moderator/administrator' replies and as such have removed the fake and malware tags. Wasn't clear what this meant at first.
I will look at the Bleeping Computer link and wait to see if I receive any further advice .
Thanks again to all.
Modified by James
Secunia's scanner is honestly not a very good program. What you are seeing is the file version of Firefox 33, not the version itself. You may have multiple installs of Firefox on your machine, which is a different problem, but this isn't malware and it's not anything to be concerned about.
Follow the steps at Update Firefox to the latest release to make sure you are on the latest version of Firefox and you should be fine. Uninstall Secunia for a long-term solution ;)
Thanks for your reply. I have seen mixed reviews online about Secunia PSI both for 2 and 3 (the latest version, but not so well received). It took me a few attempts to actually get PSI 2 to scan, and I have had a problem trying to register on their support forum. Emailed them about this but no reply yet. So I am unable to post on their forum. Not a very good experience altogether really. I decided to install it initially because this Tech guy who writes for a UK broadsheet newspaper I follow kept on recommending it, I think I might be giving him some Feedback.
I do have the latest version of Firefox (36.0.04) installed and it is listed further down as such by Secunia PSI in the correct location in Programme files . I only have one outstanding 'vulnerability' listed and it is this Firefox 33 file in this odd folder 'erdnt'
I have found a similar post in the Secunia forum from 2011 and it was recommended that the file can be deleted safely as it is associated with a 'Registry utility called ERUNT' ( I can't find any such utility on my PC).
I have pasted this reference from the Secunia forum in sq brackets below :
I have Firefox 6 installed, but it's showing v. 5 as waiting for an update. C/WINDOWS/ERDNT/cache/firefox.exe 22.214.171.124.205
The ERDNT folder is associated with a Registry utility called ERUNT. You can safely delete this file' ]
As I have been unable to Post on the Secunia forum I have not been able to check this recommendation out and as my computer skills are fairly basic I did not want to delete anything I might regret without getting a second opinion or further info on this Firefox file and its location. Which is why I posted my question in the Firefox support forum.
PS. Not sure why I am getting these slide bars on my replies. May have clicked something by mistake !
edited by removing spaces before first character of each sentence to remove scroll bars.
Modified by James
Those are because the first character on that line is a space, and when the space is first, it becomes a format command.
OK,thanks. Better keep things closed up and tight to left margin. Still not sure what format command I unintentionally triggered.
It was the space as the first character;
Could it be that ERUNT has been installed by one of your security software? Or by a technician?
Also, I would scan firefox.exe (the one in erdnt) with www.virustotal.com.
If erunt was installed there is no sign of it on my PC that I can find, only this erdnt folder.I have got some good antimalware installed and it has never picked up anything. I am going to run Microsoft's Safety scanner but I am not convinced malware is involved. Not come across virustotal before but will have a look at it. Thanks.