Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Cuireadh an snáithe seo sa chartlann. Cuir ceist nua má tá cabhair uait.

I got a red screen with the Firefox logo that says "Urgent Firefox update" asking to save the file firefox-patch.exe. This this real?

  • 14 freagra
  • 26 leis an bhfadhb seo
  • 6 views
  • Freagra is déanaí ó the-edmeister

more options

I got a very official looking red screen with the Firefox logo titled "Urgent Firefox update". It had the normal looking opening file box asking me if I wanted to save the file: firefox-patch.exe, a binary file from https://ahghointernetno.net . I closed the window and started researching if this was real. I did make a print screen copy to WordPad but was unable to upload it here do to unsupported file type.

I got a very official looking red screen with the Firefox logo titled "Urgent Firefox update". It had the normal looking opening file box asking me if I wanted to save the file: firefox-patch.exe, a binary file from https://ahghointernetno.net . I closed the window and started researching if this was real. I did make a print screen copy to WordPad but was unable to upload it here do to unsupported file type.

All Replies (14)

more options

hello, this is a scam tactic that is trying to trick you into installing malware, so don't download or execute this kind of stuff! only download firefox from its official location at mozilla.org - in addition updates are handled automatically by firefox so you don't have to download anything (you can initiate a check for updates in the firefox menu ≡ > help ? > about firefox).

you might also want to run a full scan of your system with the security software already in place and different tools like the free version of malwarebytes & adwcleaner in order to make sure that there isn't already some sort of malware active on your system that triggers these false alerts.

Troubleshoot Firefox issues caused by malware

more options

Thank you Philipp. I ran an extra Norton full scan (I do run these regularly every week) and I downloaded and ran malwarebytes. Both found nothing. I did not download adwcleaner because cnet could not guarantee it was safe. I had the same "Urgent FireFox update" screen pop up again, yesterday except for the url and the "binary file from..." url were different.

more options

I have had the same thing pop up on me. Twice, while on different webpages. I was smart enough to go to mozilla.com and check for updates there. I screenshot the page, with the URL and reported it to Mozilla as a copyright infringement, since the page has the Firefox "swirl" on it.

more options

I just got the same thing moments ago , it looks like a Firefox logo (orange page with fox swirl in middle) , the URL was completely different though , and after i closed it (and the .exe that popped up) i went to my History and it did not show up (it opened up as a Tab) , so i have no record of the URL , i then went to Firefox Help and checked for Updates and it said mine was up to date , this is the second time in a few months this has happened , is it on YOUR end or on ours ??? , or both ?? , so far no scan has detected anything on my system , so i am stumped as to its origin

EDIT: I just did a scan with SuperAntiSpyware Remover and it found nothing as well

Athraithe ag JimDirt ar

more options

Jim, more than likely that is on the website or delivered thru the website. The main thing to realize is that Firefox doesn't use .exe files to provide updates, it use .mar files which the user never see's and it works cross-operating system. The .exe type file only works on Windows OS's, Mac and Linux can't handle an .exe file type.

If you report that stuff, you can help Mozilla add it to the blocklist. Help > Report Web Forgery ... - the URL will be automatically filled in.

This is what the reporting page looks like - https://www.google.com/safebrowsing/report_phish/

more options

the-edmeister said

Jim, more than likely that is on the website or delivered thru the website. The main thing to realize is that Firefox doesn't use .exe files to provide updates, it use .mar files which the user never see's and it works cross-operating system. The .exe type file only works on Windows OS's, Mac and Linux can't handle an .exe file type. If you report that stuff, you can help Mozilla add it to the blocklist. Help > Report Web Forgery ... - the URL will be automatically filled in. This is what the reporting page looks like - https://www.google.com/safebrowsing/report_phish/

Unfortunately , i was not able to get the URL , because i closed the page before trying to copy it from the address bar , not thinking that it would not show up in History , then i went to "History" and it was not there , as i was going to post it here , but i could not find it , its like it did not register with Firefox History even though the page was there and had a address , how do i retrieve it if it did not save ??? , or am i out of luck till it does it again and i copy it from the address bar ??

more options

I have had the same problem, on two different computers. As long as I don't click on the link, is my computer OK? I'm worried that just because the page keeps popping up that there is some malware being installed. I have run several scans with Malwarebytes and Microsoft Security Essentials and have found nothing.

Is there any way to prevent this from happening?

more options

hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring?

more options

philipp said

hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring?

Now that I think about it, I believe it has always happened when visiting http://www.cincinnatibell.net/

more options

you could try if using an adblocker addon is making a difference: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

more options

philipp said

you could try if using an adblocker addon is making a difference: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

Thanks! I will do that. I have a pop-up blocker, but obviously that is not working for this problem. If the problem happens again, is there anything else I should be making note of? I have seen a lot of people on this forum talking about the same thing, and they are mentioning the URL of the page that is popping up, and other things that make no sense to me. :)

I did note that the download was "firefox-page.exe" and that it was from https://eixodbusinesspme.org

more options

I just tried to open Firefox again this morning and got a message "Firefox is updating to the latest version". How can I know that this is a legitimate update and not part of this fake update?

more options

Lets hope it was genuine. I am not sure we know what the fake files do. You should be on Firefox v47.0 or v47.01.1 if you are on the standard release channel. Key in to the address bar about:support then press Enter & you should get the Troubleshooting Information page that will confirm your Firefox version.

more options

lmcost said

philipp said
hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring?

Now that I think about it, I believe it has always happened when visiting http://www.cincinnatibell.net/

Bingo! I get that in my default Profile and also get the "patch.exe" popup when I clicked to "Allow" Flash.

IMO, the people who use http://www.cincinnatibell.net/ should report this to that website. I think that web site is being exploited or an ad network that places advertisements in that website is causing that to happen.

uBlock Origin is probably blocking that crap in my configured everyday Profile.

You can see most of the URL I got in the screenshot I posted below. I reported that using Help > Report deceptive site ... which used to be named Report Web Forgery in earlier versions of Firefox.