X
Tap here to go to the mobile version of the site.

Support Forum

I got a red screen with the Firefox logo that says "Urgent Firefox update" asking to save the file firefox-patch.exe. This this real?

Posted

I got a very official looking red screen with the Firefox logo titled "Urgent Firefox update". It had the normal looking opening file box asking me if I wanted to save the file: firefox-patch.exe, a binary file from https://ahghointernetno.net . I closed the window and started researching if this was real. I did make a print screen copy to WordPad but was unable to upload it here do to unsupported file type.

I got a very official looking red screen with the Firefox logo titled "Urgent Firefox update". It had the normal looking opening file box asking me if I wanted to save the file: firefox-patch.exe, a binary file from https://ahghointernetno.net . I closed the window and started researching if this was real. I did make a print screen copy to WordPad but was unable to upload it here do to unsupported file type.

Additional System Details

Installed Plug-ins

  • Adobe PDF Plug-In For Firefox and Netscape 15.16.20045
  • Intel web components updater - Installs and updates the Intel web components
  • Intel web components for Intel® Identity Protection Technology
  • NPWLPG
  • Shockwave Flash 21.0 r0
  • WildTangent Games App V2 Presence Detector

Application

  • Firefox 47.0
  • User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
  • Support URL: https://support.mozilla.org/1/firefox/47.0/WINNT/en-US/

Extensions

  • Firefox Hello 1.3.2 (loop@mozilla.org)
  • Multi-process staged rollout 1.0 (e10srollout@mozilla.org)
  • Pocket 1.0.2 (firefox@getpocket.com)
  • Norton Identity Safe 2016.6.0.66 ({C1A2A613-35F1-4FCF-B27F-2840527B6556}) (Inactive)

Javascript

  • incrementalGCEnabled: True

Graphics

  • adapterDescription: Intel(R) HD Graphics 4600
  • adapterDescription2:
  • adapterDeviceID: 0x0416
  • adapterDeviceID2:
  • adapterDrivers: igdumdim64 igd10iumd64 igd10iumd64 igd12umd64 igdumdim32 igd10iumd32 igd10iumd32 igd12umd32
  • adapterDrivers2:
  • adapterRAM: Unknown
  • adapterRAM2:
  • adapterSubsysID: 1977103c
  • adapterSubsysID2:
  • adapterVendorID: 0x8086
  • adapterVendorID2:
  • direct2DEnabled: True
  • directWriteEnabled: True
  • directWriteVersion: 10.0.10586.0
  • driverDate: 11-18-2015
  • driverDate2:
  • driverVersion: 20.19.15.4331
  • driverVersion2:
  • info: {u'AzureCanvasAccelerated': 0, u'AzureCanvasBackend': u'direct2d 1.1', u'AzureFallbackCanvasBackend': u'cairo', u'AzureContentBackend': u'direct2d 1.1'}
  • isGPU2Active: False
  • numAcceleratedWindows: 3
  • numTotalWindows: 3
  • supportsHardwareH264: Yes
  • webglRenderer: Google Inc. -- ANGLE (Intel(R) HD Graphics 4600 Direct3D11 vs_5_0 ps_5_0)
  • windowLayerManagerRemote: True
  • windowLayerManagerType: Direct3D 11

Modified Preferences

Misc

  • User JS: No
  • Accessibility: No
philipp
  • Top 25 Contributor
  • Moderator
5320 solutions 23502 answers

Helpful Reply

hello, this is a scam tactic that is trying to trick you into installing malware, so don't download or execute this kind of stuff! only download firefox from its official location at mozilla.org - in addition updates are handled automatically by firefox so you don't have to download anything (you can initiate a check for updates in the firefox menu ≡ > help ? > about firefox).

you might also want to run a full scan of your system with the security software already in place and different tools like the free version of malwarebytes & adwcleaner in order to make sure that there isn't already some sort of malware active on your system that triggers these false alerts.

Troubleshoot Firefox issues caused by malware

hello, this is a scam tactic that is trying to trick you into installing malware, so don't download or execute this kind of stuff! only download firefox from its official location at mozilla.org - in addition updates are handled automatically by firefox so you don't have to download anything (you can initiate a check for updates in the firefox ''menu ≡ > help ? > about firefox''). you might also want to run a full scan of your system with the security software already in place and different tools like the [https://www.malwarebytes.org/antimalware/ free version of malwarebytes] & [https://toolslib.net/downloads/viewdownload/1-adwcleaner/ adwcleaner] in order to make sure that there isn't already some sort of malware active on your system that triggers these false alerts. [[Troubleshoot Firefox issues caused by malware]]

Question owner

Thank you Philipp. I ran an extra Norton full scan (I do run these regularly every week) and I downloaded and ran malwarebytes. Both found nothing. I did not download adwcleaner because cnet could not guarantee it was safe. I had the same "Urgent FireFox update" screen pop up again, yesterday except for the url and the "binary file from..." url were different.

Thank you Philipp. I ran an extra Norton full scan (I do run these regularly every week) and I downloaded and ran malwarebytes. Both found nothing. I did not download adwcleaner because cnet could not guarantee it was safe. I had the same "Urgent FireFox update" screen pop up again, yesterday except for the url and the "binary file from..." url were different.
tammyr112 1 solutions 3 answers

Helpful Reply

I have had the same thing pop up on me. Twice, while on different webpages. I was smart enough to go to mozilla.com and check for updates there. I screenshot the page, with the URL and reported it to Mozilla as a copyright infringement, since the page has the Firefox "swirl" on it.

I have had the same thing pop up on me. Twice, while on different webpages. I was smart enough to go to mozilla.com and check for updates there. I screenshot the page, with the URL and reported it to Mozilla as a copyright infringement, since the page has the Firefox "swirl" on it.
JimDirt 4 solutions 84 answers

I just got the same thing moments ago , it looks like a Firefox logo (orange page with fox swirl in middle) , the URL was completely different though , and after i closed it (and the .exe that popped up) i went to my History and it did not show up (it opened up as a Tab) , so i have no record of the URL , i then went to Firefox Help and checked for Updates and it said mine was up to date , this is the second time in a few months this has happened , is it on YOUR end or on ours ??? , or both ?? , so far no scan has detected anything on my system , so i am stumped as to its origin

EDIT: I just did a scan with SuperAntiSpyware Remover and it found nothing as well

I just got the same thing moments ago , it looks like a Firefox logo (orange page with fox swirl in middle) , the URL was completely different though , and after i closed it (and the .exe that popped up) i went to my History and it did not show up (it opened up as a Tab) , so i have no record of the URL , i then went to Firefox Help and checked for Updates and it said mine was up to date , this is the second time in a few months this has happened , is it on YOUR end or on ours ??? , or both ?? , so far no scan has detected anything on my system , so i am stumped as to its origin EDIT: I just did a scan with SuperAntiSpyware Remover and it found nothing as well

Modified by JimDirt

the-edmeister
  • Top 25 Contributor
  • Moderator
5411 solutions 40297 answers

Jim, more than likely that is on the website or delivered thru the website. The main thing to realize is that Firefox doesn't use .exe files to provide updates, it use .mar files which the user never see's and it works cross-operating system. The .exe type file only works on Windows OS's, Mac and Linux can't handle an .exe file type.

If you report that stuff, you can help Mozilla add it to the blocklist. Help > Report Web Forgery ... - the URL will be automatically filled in.

This is what the reporting page looks like - https://www.google.com/safebrowsing/report_phish/

Jim, more than likely that is on the website or delivered thru the website. The main thing to realize is that Firefox doesn't use '''.exe''' files to provide updates, it use .mar files which the user never see's and it works cross-operating system. The .exe type file only works on Windows OS's, Mac and Linux can't handle an .exe file type. If you report that stuff, you can help Mozilla add it to the blocklist. '''Help''' > '''Report Web Forgery ...''' - the URL will be automatically filled in. This is what the reporting page looks like - https://www.google.com/safebrowsing/report_phish/
JimDirt 4 solutions 84 answers

the-edmeister said

Jim, more than likely that is on the website or delivered thru the website. The main thing to realize is that Firefox doesn't use .exe files to provide updates, it use .mar files which the user never see's and it works cross-operating system. The .exe type file only works on Windows OS's, Mac and Linux can't handle an .exe file type. If you report that stuff, you can help Mozilla add it to the blocklist. Help > Report Web Forgery ... - the URL will be automatically filled in. This is what the reporting page looks like - https://www.google.com/safebrowsing/report_phish/

Unfortunately , i was not able to get the URL , because i closed the page before trying to copy it from the address bar , not thinking that it would not show up in History , then i went to "History" and it was not there , as i was going to post it here , but i could not find it , its like it did not register with Firefox History even though the page was there and had a address , how do i retrieve it if it did not save ??? , or am i out of luck till it does it again and i copy it from the address bar ??

''the-edmeister [[#answer-890201|said]]'' <blockquote> Jim, more than likely that is on the website or delivered thru the website. The main thing to realize is that Firefox doesn't use '''.exe''' files to provide updates, it use .mar files which the user never see's and it works cross-operating system. The .exe type file only works on Windows OS's, Mac and Linux can't handle an .exe file type. If you report that stuff, you can help Mozilla add it to the blocklist. '''Help''' > '''Report Web Forgery ...''' - the URL will be automatically filled in. This is what the reporting page looks like - https://www.google.com/safebrowsing/report_phish/ </blockquote> Unfortunately , i was not able to get the URL , because i closed the page before trying to copy it from the address bar , not thinking that it would not show up in History , then i went to "History" and it was not there , as i was going to post it here , but i could not find it , its like it did not register with Firefox History even though the page was there and had a address , how do i retrieve it if it did not save ??? , or am i out of luck till it does it again and i copy it from the address bar ??
mcost 0 solutions 4 answers

I have had the same problem, on two different computers. As long as I don't click on the link, is my computer OK? I'm worried that just because the page keeps popping up that there is some malware being installed. I have run several scans with Malwarebytes and Microsoft Security Essentials and have found nothing.

Is there any way to prevent this from happening?

I have had the same problem, on two different computers. As long as I don't click on the link, is my computer OK? I'm worried that just because the page keeps popping up that there is some malware being installed. I have run several scans with Malwarebytes and Microsoft Security Essentials and have found nothing. Is there any way to prevent this from happening?
philipp
  • Top 25 Contributor
  • Moderator
5320 solutions 23502 answers

hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring?

hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring?
mcost 0 solutions 4 answers

philipp said

hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring?

Now that I think about it, I believe it has always happened when visiting http://www.cincinnatibell.net/

''philipp [[#answer-892821|said]]'' <blockquote> hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring? </blockquote> Now that I think about it, I believe it has always happened when visiting http://www.cincinnatibell.net/
philipp
  • Top 25 Contributor
  • Moderator
5320 solutions 23502 answers

you could try if using an adblocker addon is making a difference: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

you could try if using an adblocker addon is making a difference: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/
mcost 0 solutions 4 answers

philipp said

you could try if using an adblocker addon is making a difference: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

Thanks! I will do that. I have a pop-up blocker, but obviously that is not working for this problem. If the problem happens again, is there anything else I should be making note of? I have seen a lot of people on this forum talking about the same thing, and they are mentioning the URL of the page that is popping up, and other things that make no sense to me. :)

I did note that the download was "firefox-page.exe" and that it was from https://eixodbusinesspme.org

''philipp [[#answer-892825|said]]'' <blockquote> you could try if using an adblocker addon is making a difference: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ </blockquote> Thanks! I will do that. I have a pop-up blocker, but obviously that is not working for this problem. If the problem happens again, is there anything else I should be making note of? I have seen a lot of people on this forum talking about the same thing, and they are mentioning the URL of the page that is popping up, and other things that make no sense to me. :) I did note that the download was "firefox-page.exe" and that it was from https://eixodbusinesspme.org
mcost 0 solutions 4 answers

I just tried to open Firefox again this morning and got a message "Firefox is updating to the latest version". How can I know that this is a legitimate update and not part of this fake update?

I just tried to open Firefox again this morning and got a message "Firefox is updating to the latest version". How can I know that this is a legitimate update and not part of this fake update?
John99 971 solutions 13138 answers

Lets hope it was genuine. I am not sure we know what the fake files do. You should be on Firefox v47.0 or v47.01.1 if you are on the standard release channel. Key in to the address bar about:support then press Enter & you should get the Troubleshooting Information page that will confirm your Firefox version.

Lets hope it was genuine. I am not sure we know what the fake files do. You should be on Firefox v47.0 or v47.01.1 if you are on the standard release channel. Key in to the address bar ''about:support'' then press Enter & you should get the Troubleshooting Information page that will confirm your Firefox version.
the-edmeister
  • Top 25 Contributor
  • Moderator
5411 solutions 40297 answers

lmcost said

philipp said
hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring?

Now that I think about it, I believe it has always happened when visiting http://www.cincinnatibell.net/

Bingo! I get that in my default Profile and also get the "patch.exe" popup when I clicked to "Allow" Flash.

IMO, the people who use http://www.cincinnatibell.net/ should report this to that website. I think that web site is being exploited or an ad network that places advertisements in that website is causing that to happen.

uBlock Origin is probably blocking that crap in my configured everyday Profile.

You can see most of the URL I got in the screenshot I posted below. I reported that using Help > Report deceptive site ... which used to be named Report Web Forgery in earlier versions of Firefox.

l''mcost [[#answer-892823|said]]'' <blockquote> ''philipp [[#answer-892821|said]]'' <blockquote> hi mcost - it would be interesting, what is triggering those popups - our current theory is that they are coming from malicious ads on websites. were you visiting any particular sites when this is occurring? </blockquote> Now that I think about it, I believe it has always happened when visiting http://www.cincinnatibell.net/ </blockquote> '''Bingo!''' I get that in my default Profile and also get the "patch.exe" popup when I clicked to "Allow" Flash. IMO, the people who use http://www.cincinnatibell.net/ should report this to that website. I think that web site is being exploited or an ad network that places advertisements in that website is causing that to happen. uBlock Origin is probably blocking that crap in my configured everyday Profile. You can see ''most of'' the URL I got in the screenshot I posted below. I reported that using Help > '''Report deceptive site ...''' which used to be named ''Report Web Forgery'' in earlier versions of Firefox.