Printable View
A few days ago while I was using firefox, another tab window opened stating "critical firefox update" and a popup window appeared asking to download "firefox-patch.js" and not thinking I downloaded it. I just received another one today but I didn't download this one. I just realized that these firefox patches are not updates pertaining to firefox and are potential viruses. Has my laptop been at risk since I downloaded the first patch about 2 days ago?
Did the JavaScript "patch" run after you downloaded it?
If you still have the downloaded file, upload it to VirusTotal to see if it is recognized.
I'd say it is time to make sure that your antivirus software has the latest update and run a full scan. After that, if you don't already have the free version installed, install MalwareBytes, update it, and run a full scan with that also.
Hi JDC2000. How do I upload it to VirusTotal?
Follow the instructions at the link below:
https://www.virustotal.com/
Click on the Choose File button to select the file.
That's not how Mozilla releases updates. More likely than not, it's a malware popup. If you didn't run the javascript (.js), you're probably ok. Isn't this the laptop you're going to return?Quote:
Firefox-patch.js
I've recommended uBlock Origin adblocker many times on this forum. I highly advise you install it, if you're seeing popups like that.
https://addons.mozilla.org/en-us/fir...ublock-origin/
When I tried to upload the file, it said that I didn't have permission to open this file. I just started using windows 10 and I didn't think I had my OS set as administrator. How can I disable the administrator feature since I am the only one using this laptop?
If you're the only user, you can't "disable" administrator rights. Otherwise, you wouldn't be able to do things like install applications.
That is already a bad sign that the .js file is malware. At this point, I'd skip the upload and run some scans. If they don't flag the file as malware and remove it, post back and let us know.
If you changed your user account to an Administrator account now, or enabled the built-in Administrator account, that might enable any malware to gain more rights. Run scans with your antivirus software and MalwareBytes. Save the logs in case this ends up in Broni's Intensive Care Unit forum.
Again, is this the laptop you are going to return to Dell? You can run a MBAM scan, but it doesn't seem worth the effort to go through the ICU process.
The firefox-patch.js is a shortcut file and when I tried to upload it using virustotal, it said file not found. I ran Malwarebutes and it said treats detected and threats quarantined was 0. I ran Avast Smart Scan and it no viruses found, no vulnerable software found, no bad browsers add-ons found but, said it found 3 issues (a conflicting anti-virus, issues on my network, and performance issues found.
I did notice the past few days that when I would being using firefox and chrome at the same time, chrome would freeze up where I would have to close it and it would freeze up my internet where I could surf the web on firefox. Then I would click task manager and go to the details section, I would notice about 6 chrome.exe listings. I would right click on them and close them out. I would reboot and open firefox again and then my connection was fine and I could surf the web again. This occurs after using chrome for awhile.
It shows that I am administrator and that is how I configured it when I first began using my laptop. I am not sure why it gave that message when I tried to upload firefox-patch.js shortcut file.
Midknyte, thank you for that UBlock add-on link. I apreicate it. I just installed it. Yes, it is the laptop that I am going to return but I want to make sure that I was vulnerable since I downloaded that firefox-patch.js file.
I want to correct a line in my previous post.
It should read: I did notice the past few days that when I would be using firefox and chrome at the same time, chrome would freeze up where I would have to close it and it would freeze up my internet where I "COULDN'T" surf the web on firefox.
It gave you that message because the malware programmers don't want you messing with their malware.Quote:
It shows that I am administrator and that is how I configured it when I first began using my laptop. I am not sure why it gave that message when I tried to upload firefox-patch.js shortcut file.
If you are returning this system, removing malware at this point would be a waste of time. You only concern would be if you have data on the system that is valuable to hackers, or if they have collected user credentials while you were using the system.
Multiple listings of chrome.exe are normal; it creates a separate process for each tab, extension, etc. Chrome is a known memory hog too. If you aren't running an adblocker, it's even worse.
If you don't have the actual .js file, then you can't upload it. There's no point in scanning shorcut .lnk files.
JDC2000, what do you mean "....collected user credentials while you were using the system?" Should I be concerned? The most personal info I had on this laptop because I didn't finish transferring all my files over from my old drive is that I had my name and address on a document file. Should I be concerned about that?
Midknyte, I wasn't aware that chrome creates a separate process for each tab and extension. I was really concerned when I noticed those multiple listings in task manager. Do you know a good adblocker to use on chrome? Shouldn't I be as worried/concerned since it appears that I only have a shortcut of the "firefox-patch.js" file and not the actual file?
Should I click "resolve all" after running Avast Smart scan?
uBlock Origin. Same as FF.Quote:
Do you know a good adblocker to use on chrome?
https://chrome.google.com/webstore/d...jbkeiagm?hl=en
If you only have the shortcut, then there's a good chance the actual files was deleted by your antivirus/antimalware already.Quote:
Shouldn't I be as worried/concerned since it appears that I only have a shortcut of the "firefox-patch.js" file and not the actual file?
Midknyte, thanks for that link. I always use "incognito" mode when I use chrome. Will this adblock work in that mode?
I am not sure if I had a AV program running at the time. I can't recall if I did. I know I had disabled Microsoft defender when I installed Avast AV freeware program. How can I check to see whether it is disabled? What is the best security programs that I should be running 24/7 in windows 10 when I surf the net? How should I have it configured?
Your name and address are probably available elsewhere.
Credentials would be something like a user name and password for sites like this one, or online banking or shopping sites. If the script installed a keylogger, those may have been collected.
The fact that only a shortcut to the script is showing could mean that the script already completed its work and deleted the original file.
If you run Task Manager, do you see a process called fileopenerpro.exe?
JDC2000, I don't see any file titled "fileopenerpro.exe" in the details section of task manager, assuming I checked the correct location in task manager.
I did log into my online banking and paid a few bills and purchased some items online. I guess there isn't a way to know if they colllected my user name and passwords from accounts that I had logged into? I'm upset and worried at the same time. How concerned should I be regarding this?
Yes. Incognito mode doesn't affect the adblocking.Quote:
I always use "incognito" mode when I use chrome. Will this adblock work in that mode?
I don't use Avast, so I don't know the exact settings. The defaults are probably fine. I'd use that and do weekly scans with MBAM. uBlock Origin should cut down on the possible malware ads/popups also.
It would be under processes. If you don't see that, and you scans did not find anything, your AV may have gotten it before it could do anything harmful. It wouldn't hurt to change passwords on user accounts you have used on this PC though.
Midknyte, I installed that add-on in chrome. I closed chrome and re-opened in cognito mode, but I don't see the icon for it at top right next to address bar. I do see it in regular mode in chrome though.
JDC2000, I don't see that file in processes. I am trying to remember all the accounts that I had logged into, so I can change my passwords. This is frustrating, as well as, upsetting.
If you want to double check
there is Sophos Free Virus Removal Tool
http://downloads.sophos.com/tools/wi...val%20Tool.exe
or if that doesn't down load for some reason, ESET Online Scanner
https://www.eset.com/us/home/online-scanner/
Midknyte, you were correct. You can run UBlock Origin in incognito mode. I noticed there is an setting that one can check to allow it to run in that mode by going to chrome://entensions. Thanks.
Train, I installed and ran Sophos and performed a complete scan and it said that it did not find any threats.
Am I being more worried than I should be regarding this patch file that was on my system?
If none of your scans found anything, you are probably OK. You should still keep an eye on activity on your various accounts, but you should be doing that anyway.
jdc2000 has the right of it.
Midknyte, JDC2000, and Train, thanks for the help. It always is greatly appreciated.