Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

Was Firefox update hijacked?

  • 2 replies
  • 3 have this problem
  • 18 views
  • Last reply by Fred

Fred
Fred
more options

Today when I opened Firefox it claimed I needed an update. When I pressed update it downloaded a file for me to run. This is as wrong as wrong can be. I stopped everything and went back in and discovered it is a hijack attempt. What would you like from me to investigate this incident?

Thanks, Fred

Today when I opened Firefox it claimed I needed an update. When I pressed update it downloaded a file for me to run. This is as wrong as wrong can be. I stopped everything and went back in and discovered it is a hijack attempt. What would you like from me to investigate this incident? Thanks, Fred
Attached screenshots

Chosen solution

Firefox updates on Windows, Mac OSX, and Linux are done internally in Firefox (by a .mar file). Or by download from www.mozilla.org or www.mozilla.org/firefox/all/

Updates are not sent to Firefox users as a .exe and the publisher of that file is not Mozilla.

This is similar to the fake firefoxpatch.exe scam that was popping up on some websites before. You did not have to be infected with anything for this to have occurred.

On a tablet so I cannot check this out further so easily.

https://www.reasoncoresecurity.com/signer-ooo-advert-m-00d456a38d6e59edd13fa4143d8336198c.aspx.

"OOO ADVERT-M is a software publisher located in Moscow, Russia*. The company is a primary distributor of potentially unwanted programs."

Read this answer in context 👍 1

All Replies (2)

James
James
  • Top 25 Contributor
  • Moderator
more options

Chosen Solution

Firefox updates on Windows, Mac OSX, and Linux are done internally in Firefox (by a .mar file). Or by download from www.mozilla.org or www.mozilla.org/firefox/all/

Updates are not sent to Firefox users as a .exe and the publisher of that file is not Mozilla.

This is similar to the fake firefoxpatch.exe scam that was popping up on some websites before. You did not have to be infected with anything for this to have occurred.

On a tablet so I cannot check this out further so easily.

https://www.reasoncoresecurity.com/signer-ooo-advert-m-00d456a38d6e59edd13fa4143d8336198c.aspx.

"OOO ADVERT-M is a software publisher located in Moscow, Russia*. The company is a primary distributor of potentially unwanted programs."

Modified by James

Fred
Fred Question owner
more options

Here is further info on the attempted hijack. I went to the Home Depot website and that is when it reopened that tab to this address:

http://autoupdate.whenupgradeswork.com/?pcl=GXtQc2nFwAI_kutxiZiCsE-dKYu0l1tu9jN2RQDSZZw.&CID=01_84594546_570ccb14-cf41-4c63-aab9-6db6509795fa&AFID=&v_id=WxHTIcyp5RTtP5huoah3h914pCAykq0W7wrjV9f4kuQ.

Screen shot is included, so you can see it looks legit.