I do malware remediation for a company. In some recent investigations, I've found a few computers using firefox, and it is running from this location: c:\users\username\appdata\local\mozilla firefox\firefox.exe. (This location exists in versions 15.0.1, 16.0.2, and 19.0.2, and probably others) Most computers run from program files\moz.FF\ - I don't believe that these users have changed the default install location. I have noticed that some of them had evidence of an update file running. All these users should be running as a local admin., and running Win7 Pro. Working in vulnerability management, we notice anything that is "out of place." I ran several searches about this, and found nothing. If this is a legitimate file location and setup, FF should document it. A VirusTotal search for the file in this location shows no hits, but user votes show 4 out of 9 believing it is malicious (anonymous votes, so who knows if these people know anything or their motives). Any help as to why this location is used would be helpful...