firefox-patch.js

[bpeby1]

My computers continue to get a fake Firefox update notice asking me download a file named firefox-patch.js. How do I get rid of it?

[Ried]

Hi bpeby1,

You mentioned your 'computers' - how many is this happening on?  For purposes of keeping things straight and not causing confusion as to which machine is which, let's deal with one at a time.

Usually, this is running from the temp cache directory. What I'd like you to do first is clear the cache in your Firefox browsers.  Follow the instructions as laid out by Mozilla:

https://support.mozilla.org/en-US/kb/how-clear-firefox-cache?redirectlocale=en-US&redirectslug=How+to+clear+the+cache

If the issue persists, I'll need to gather more information as to what's running on the machine and try to locate the source.

This next scanner will not make any changes to your machine on its own, nor will it divulge any personal information that may compromise your security.

Please download Farbar Recovery Scan Tool from here http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ and save it to your desktop.

Note: You need to run the version compatible with your system.

**After you click the Download Now 64-bit, or the Download Now 32-bit, another page will open — DO NOT CLICK ANY ADDITIONAL 'download now' buttons, just wait and look toward the bottom of your browser for the option to Run or Save. Click Save.

•Double-click to run it. When the tool opens click Yes to the disclaimer.

Note: If you are prompted by Windows SmartScreen, click More info followed by Run anyway.

•Click the Scan button.

•When the scan has finished, it will save 2 logs  in the same directory the tool was run from.  Please attach the following logs:

Addition.txt

FRST.txt 

 

 

[bpeby1]

It's happening on 2 Windows 10 64-bit computers. Attached are the 2 files requested for #1 computer. I will focus only on that computer until you tell me differently.

Thanks, Brian

Addition.txt

FRST.txt

[Ried]

Did you try emptying the temp cache? I'll assume you did.

I'm not seeing any source visible in the logs, and you've already tried AdwCleaner and JRT so  what I'll do is clear the temp directory as well, and flush the dns. Flushing the DNS resets it at the IP level. It clears any IP cache. It forces the computer to empty the cache and forget everything it knows about DNS entries that it’s looked up previously which makes it start asking the DNS server for new and up-to-date information as you reference domains by name thereafter. 

Download the attached Fixlist.txt and save it in the same location as FRST64.exe.  Both the Fixlist.txt and FRST64.exe must be in the same location for the script to execute.

1. Double click FRST64.exe to launch the tool

2. When the tool opens, click the *FIX BUTTON*.

3. Once it has finished, a Fixlog.txt will open and also have been saved in the same location the tool was run from.

Please send me the Fixlog.txt in your next reply along with an update on machine behavior.

.

Fixlist.txt

[bpeby1]

Attached is the Fixlog.txt you requested. I don't know if anything changed on the computer yet because the firefox-patch.js notice only appeared intermittently.

 

 

Fixlog.txt

[Ried]

Okay, then all we can do is wait and see.  Let me know if you see it again

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!