X
Tap here to go to the mobile version of the site.

Support Forum

Should I install this download: FirefoxPatch.exe received today?

Posted

This download appeared today and I have downloaded it but not installed it as I am worried it may be maleware. Instead, I refreashed FireFox. I have had multiple crashes on multiple web sites in the past few weeks so I was tempted to install this patch but then thought; I better check it out first.

Any advice?

This download appeared today and I have downloaded it but not installed it as I am worried it may be maleware. Instead, I refreashed FireFox. I have had multiple crashes on multiple web sites in the past few weeks so I was tempted to install this patch but then thought; I better check it out first. Any advice?

Chosen solution

Hi, that sounds very suspicious - don't install it!

If you are in any doubt about the authenticity of update pop-ups etc., it's best to ignore them and check for yourself by opening the 3-bar menu > Help (question mark at bottom right) > About Firefox.

If your question is resolved by this or another answer, please take a minute to let us know. Thank you.

Read this answer in context 23

Additional System Details

Installed Plug-ins

  • Adobe PDF Plug-In For Firefox and Netscape 11.0.13
  • Google Update
  • Intel web components for Intel® Identity Protection Technology
  • Intel web components updater - Installs and updates the Intel web components
  • Picasa plugin
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Shockwave Flash 19.0 r0
  • 5.1.40728.0
  • iTunes Detector Plug-in

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0

More Information

Scribe 725 solutions 3456 answers

Chosen Solution

Hi, that sounds very suspicious - don't install it!

If you are in any doubt about the authenticity of update pop-ups etc., it's best to ignore them and check for yourself by opening the 3-bar menu > Help (question mark at bottom right) > About Firefox.

If your question is resolved by this or another answer, please take a minute to let us know. Thank you.

Hi, that sounds very suspicious - don't install it! If you are in any doubt about the authenticity of update pop-ups etc., it's best to ignore them and check for yourself by opening the 3-bar menu > Help (question mark at bottom right) > About Firefox. ''If your question is resolved by this or another answer, please take a minute to let us know. Thank you.''
FredMcD
  • Top 10 Contributor
4147 solutions 57893 answers

Helpful Reply

. Whenever you get a message / popup that software / files need to be updated;

DO NOT USE ANY OF THE PROVIDED LINKS

While this may be a legitimate message, it could also be Malware or a Virus. Any time you want or need to check for upgrades, go to the web site of the True Owner of the program in question. For example, to check out Firefox, go to Mozilla.org. {web link}

You can also report such a site at; Google Report Phishing Page {web link} which is the same when done while on site by going to Help > Report Web Forgery

Help us safeguard Mozilla’s trademarks by reporting misuse {web link}

. '''Whenever you get a message / popup that''' '''software / files need to be updated;''' <u>'''DO NOT USE ANY OF'''</u> <u>'''THE PROVIDED LINKS'''</u> While this may be a legitimate message, it could also be <u>'''Malware or a Virus'''</u>. Any time you want or need to check for upgrades, go to the web site of the <u>'''True Owner'''</u> of the program in question. For example, to check out Firefox, go to '''[https://www.mozilla.org Mozilla.org]'''. {web link} You can also report such a site at; '''[http://www.google.com/safebrowsing/report_phish/ Google Report Phishing Page]''' {web link} which is the same when done while on site by going to '''Help > Report Web Forgery''' '''[http://www.mozilla.org/en-US/legal/fraud-report/ Help us safeguard Mozilla’s trademarks by reporting misuse]''' {web link}
James
  • Top 25 Contributor
  • Moderator
1593 solutions 11222 answers

Helpful Reply

Firefox updates are never done by way of a .exe

Firefox is not just for Windows as it is for Mac OSX and Linux also so updates are done either in Firefox itself (with a .mar file) or by download from mozilla.org

You already have Firefox 42.0 which is the current Release which was released on Nov 3rd.

Firefox updates are never done by way of a .exe Firefox is not just for Windows as it is for Mac OSX and Linux also so updates are done either in Firefox itself (with a .mar file) or by download from [https://www.mozilla.org/firefox/all mozilla.org] You already have Firefox 42.0 which is the current Release which was released on Nov 3rd.

Modified by James

Question owner

Timely advice from three Mozilla experts; all confirmed this was not something to install as Mozilla would not use an .exe file as an update or problem fix. I am a bit wiser now thanks to the three mozilla-kateers ...

Timely advice from three Mozilla experts; all confirmed this was not something to install as Mozilla would not use an .exe file as an update or problem fix. I am a bit wiser now thanks to the three mozilla-kateers ...
harvestland 0 solutions 3 answers

I was just prompted to install this from a website "phaccounty-taxes.net" . The file installs Cryptolocker, under no circumstances should you install this file. It is the Cryptolocker trojan. What is worse is all I did was open a new tab in FireFox. I did not click on anything, no email, new tabs are set to blank. Two other of my computers on different networks were infected by Cryptolocker and we could not find the source as browsing history showed no ad clicks or out of the ordinary site visits, and no email attachments were opened. Apparently when FireFox is opened and goes to check for updates it is hijacked and you are redirected to a false website to install the Patch. This means there is a security hole in FireFox. Cryptolocker is a terrible trojan it encrypts all your data files and holds your files ransom for $500.00. If you do not pay your files are unrecoverable. FireFox please fix this!

I was just prompted to install this from a website "phaccounty-taxes.net" . The file installs Cryptolocker, under no circumstances should you install this file. It is the Cryptolocker trojan. What is worse is all I did was open a new tab in FireFox. I did not click on anything, no email, new tabs are set to blank. Two other of my computers on different networks were infected by Cryptolocker and we could not find the source as browsing history showed no ad clicks or out of the ordinary site visits, and no email attachments were opened. Apparently when FireFox is opened and goes to check for updates it is hijacked and you are redirected to a false website to install the Patch. This means there is a security hole in FireFox. Cryptolocker is a terrible trojan it encrypts all your data files and holds your files ransom for $500.00. If you do not pay your files are unrecoverable. FireFox please fix this!
James
  • Top 25 Contributor
  • Moderator
1593 solutions 11222 answers

You need to get Cryptolocker uninstalled on your Windows since you ran that Fake Firefox patch .exe file.

https://malwaretips.com/blogs/remove-cryptolocker-virus/

You need to get Cryptolocker uninstalled on your Windows since you ran that Fake Firefox patch .exe file. https://malwaretips.com/blogs/remove-cryptolocker-virus/

Modified by James

InFor3 0 solutions 4 answers

Hi, I found more info on this FirefoxPatch.exe malware. I posted the info on another similar Mozilla support thread: https://support.mozilla.org/en-US/que.../1092584#answer-818322.

The source of how the user is re-directed to the fake Firefox Update Center website is actually from the website that the user was browsing on. It is called "malvertising" and even browsing on legitimate websites can re-direct the user's browsers to a malware webpage. So, please don't download files before researching carefully if it's legitimate first and warn others! Thank you.

Btw, the malware website that I got redirected to was "thitueasyexport.net".

Hi, I found more info on this FirefoxPatch.exe malware. I posted the info on another similar Mozilla support thread: [https://support.mozilla.org/en-US/questions/1092584#answer-818322]. The source of how the user is re-directed to the fake Firefox Update Center website is actually from the website that the user was browsing on. It is called "malvertising" and even browsing on legitimate websites can re-direct the user's browsers to a malware webpage. So, please don't download files before researching carefully if it's legitimate first and warn others! Thank you. Btw, the malware website that I got redirected to was "thitueasyexport.net".

Modified by InFor3

Abzyx 0 solutions 8 answers

I'm attaching an image of a bogus Firefox Security Warning I was redirected to on December 9. Here's a virustotal analysis of the 288 KB download (I had earlier seen a 348 KB version): virustotal firefoxpatch . And here's a virustotal analysis of the download URL: virustotal phaccounty-taxes .

Multiple security products have now detected no threats on my PC. The best defense appears to be ad-blocking browser add-ons. I haven't seen any more redirects even from reported malvertising websites since installing Adblock Plus and unchecking "allow some non-intrusive advertising." (Certain ads at one website were apparently of the "non-intrusive malvertising" variety.)

I'm attaching an image of a bogus Firefox Security Warning I was redirected to on December 9. Here's a virustotal analysis of the 288 KB download (I had earlier seen a 348 KB version): [https://www.virustotal.com/en/file/b7fa31e1332cb202aab86afc093fd99ee2f49362bb36babece20344716806e14/analysis/ virustotal firefoxpatch] . And here's a virustotal analysis of the download URL: [https://www.virustotal.com/en/url/19b128bff22d457ea0dbd6cb76c0cb2d16b432f8f8b68925d1c3674707a1cfde/analysis/1450537949/ virustotal phaccounty-taxes] . Multiple security products have now detected no threats on my PC. The best defense appears to be ad-blocking browser add-ons. I haven't seen any more redirects even from reported malvertising websites since installing Adblock Plus and unchecking "allow some non-intrusive advertising." (Certain ads at one website were apparently of the "non-intrusive malvertising" variety.)