I will bet you a nickel that that is exactly the case, or he/it has already loaded the phony firefox patch. The site was registered 2 days ago. I would also bet that soon the account registration will be deleted / cancelled because that was my experience (but I was proactive and may have forced their hand.) I am interested in what else the URL contains after the slash, if anything, and look in your history list for the oldest line with the same URL. And what is the entry below that one I ask? I am one of you; not an approved authority, but trust me on this. As for backing out the possible malware (ff-patch), I offer nothing. Note I restored my FF to original-conditions once and did not like the result; lost history, etc.

I pose this question: did you upgrade FF or load a patch which suddenenly appeared on your screen? (orange page.)

Yes it did pop up suddenly and appeared to as an orange screen that would not go away except to completely closing out Foxfire and starting over. First time it happened tried to down load the patch but Norton denied the attempt so haven't attempted any more downloads.

https://aijohintaste.net/9591266187345/9591266187345/1467915529533817/firefox-patch.exe this is the download link that I received

Hi, we are getting a lot of reports like yours of late - it's a scam designed to infect you with malware! NEVER EVER click on anything like that.

If you are in any doubt about the authenticity of update pop-ups etc., it's always best to ignore them and check for yourself by opening the 3-bar menu > Help (question mark at bottom right) > About Firefox. Alternatively, you can press the Alt key to bring up the main menu bar > Help > About Firefox. More - Update Firefox to the latest release.

A possible workaround is to install an ad-blocker, such as -

https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/?src=ss

Or https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/?src=ss

For reference only - please don't post here - this forum is for Mozilla Support Contributors only https://support.mozilla.org/en-US/forums/contributors/712056?last=69507

If your question is resolved by this or another answer, please take a minute to let us know. Thank you.

Doctor, it hurts when i do this. Response: "Well, don't do that"

Why the humor? What to do, or not do next time, doesn't really solve the problem this time. Ad blockers may be the answer next time, yet the routine might not be an ad at all, but it does seem to start with an ad on a web page. That's from my research, and I'm only a beginner. :)

I could not connect to the URL you supplied. Might be FF blocking it, or might be my ISP, or the site might have been delisted or shut down (if the powers that be can do that because of the problems caused.

Go to the support page mentioned above. I'll try to post more background, if they let me. For now, see if anyone else suggests you 'restore' your registry to an earlier date and/or download another copy of FF from the official site. I disliked my attempt to 'restore to factory settings' and I also was sorry I once deleted FF. You may indeed have been infected. (don't want to spread panic, but...) My guess (yea, more) is you can't get affected again BUT it is possible that whatever bad stuff did download may be trying to connect with "the bad guys."

BTW, the site was registered on 7/11. In many/several cases the 'patch' on the orange screen begins on the next day and probably only lasts that long.

PS you supplied two URL's. I only checked one. Regardless, don't go there.

Note the URLs used as the address in the screen with the orange background and illegal ligo do not help much. The sites tend to be temporary. And the links used are somehow personalised so do not work for those trying to investigate this menace.

Barbara

How are you getting on with using Firefox . If you still have problems

1. Please run all the scans mentioned in the article Troubleshoot Firefox issues caused by malware
2. Please try this special tool for Korvter removal LINK to instructions please read those instructions and note they contain the link for downloading the tool itself. You will need the 64 bit version. The instructions contain the link for the file.
   • Note the tool reports if nothing is found, or generated a short log file if it finds anything. It would be interesting to see the content of the log file.

Please post back to say how you get on, or if you need further help.