# Malware: Urgent Firefox Update **URL:** \ **Category:** About This Message Board\ **Created:** [July 16, 2016, 8:18pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074 "2016-07-16T20:18:28Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Alley\_Dweller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alley_dweller/32/430_2.png) [@Alley\_Dweller](https://boards.straightdope.com/u/Alley_Dweller)\ **Post date:** [July 16, 2016, 8:18pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/1 "2016-07-16T20:18:28Z")
Twice now, when I’ve opened an SMDB page, it has popped up a new tab in Firefox that looks like this: [http://imgur.com/4bHTt8N](http://imgur.com/4bHTt8N) It is trying to get me to download an “urgent Firefox update.” The url of this page is: [spoiler][https://queidwhoreslag.net/9291157587323/fd2e0cac6abf1466b48c0c135b0ec692.html[/spoiler]](https://queidwhoreslag.net/9291157587323/fd2e0cac6abf1466b48c0c135b0ec692.html%5B/spoiler%5D) The page that caused the new tab to open had these two ads on it: [Imgur: The magic of the Internet](http://imgur.com/XgbpVhF) [http://imgur.com/1G94uJb](http://imgur.com/1G94uJb) The URLs of the two ads are: [https://secure.flashtalking.com/47145/ON\_Product\_HTML5\_RL\_728x90\_v1c/index.html](https://secure.flashtalking.com/47145/ON_Product_HTML5_RL_728x90_v1c/index.html) [http://d.adroll.com/r/ISRFVJ4CYZEJLCRYPCOWW4/XRVEJ4F2K5DF7C2C4OV7OI/0e4b9bc199084bda05bb929a3792a100.re?adroll\_height=600&adroll\_width=160&site\_url=http%3A//boards.straightdope.com&adroll\_ad\_payload=\_\_HIAb4BkwHaAazIAagAAbvHoMSyLSos1DkkNNg7JMjd0cU90jjEz8TD11hqm5G7uYtnuEmUm5uja4izi6lvQLhfmKfFtmBnv1BfE6\_gADc3szB3FydzN4uAIH-rcwy8617bbEzKSUzOjk\_Kr4gvKMpMzsxLdzsuyDR3\_\_Ynn9d8uHTy1PR953d9nM3qzuB9yI8\_5qwBR-ms0mLd8tTiEl2jxJr\_tf\_PdO7JKCkpsNLXLy8v1ysuKUrMTM8oSckvSNVLzs\_VPzP7XHhXT8aZBduT8hOLUooxVJxZxHBm8eEzS4TOnFpulJZilGqQdOb0cTaWiecYRF5\_PnMG6Jo1r\_Zs6u5q\_P0e5pozv47zMjeuSC3LTMnPiy85azXjzN\_JBnqmZxmVbzEoJ5omGliYJhubGViYWSYaJZuaJqWYppkbJVuaGBlamqZY5RSdZYo4x8AaIHeWKXJ1cWFBaXp8mWm8oelZpqjDZ5lizzG0vftxlikOHEJnmU7cYlAwNDdLMzFNSk41tjRLNjI0s7BITDRONjMzSUpONDc2Tj7L4nP4LOuq1QVF-cUFqcklwHA8y5ZxVuYHAKwdnVD-BD5ey9st5oY&adroll\_subnetwork=r&cpm=BF7A3904C10539BC&adroll\_network=n&clickurl=http%3A//beacon-us-west.rubiconproject.com/beacon/rs/9a91d425-db49-41e4-9ebf-8640a3fcb94f/0/I7Vrj49xgSSRGnOClmMvdfOh8zs/%3Furl%3D](http://d.adroll.com/r/ISRFVJ4CYZEJLCRYPCOWW4/XRVEJ4F2K5DF7C2C4OV7OI/0e4b9bc199084bda05bb929a3792a100.re?adroll_height=600&adroll_width=160&site_url=http%3A//boards.straightdope.com&adroll_ad_payload= __HIAb4BkwHaAazIAagAAbvHoMSyLSos1DkkNNg7JMjd0cU90jjEz8TD11hqm5G7uYtnuEmUm5uja4izi6lvQLhfmKfFtmBnv1BfE6_gADc3szB3FydzN4uAIH-rcwy8617bbEzKSUzOjk_Kr4gvKMpMzsxLdzsuyDR3__ Ynn9d8uHTy1PR953d9nM3qzuB9yI8_5qwBR-ms0mLd8tTiEl2jxJr_tf_PdO7JKCkpsNLXLy8v1ysuKUrMTM8oSckvSNVLzs_VPzP7XHhXT8aZBduT8hOLUooxVJxZxHBm8eEzS4TOnFpulJZilGqQdOb0cTaWiecYRF5_PnMG6Jo1r_Zs6u5q_P0e5pozv47zMjeuSC3LTMnPiy85azXjzN_JBnqmZxmVbzEoJ5omGliYJhubGViYWSYaJZuaJqWYppkbJVuaGBlamqZY5RSdZYo4x8AaIHeWKXJ1cWFBaXp8mWm8oelZpqjDZ5lizzG0vftxlikOHEJnmU7cYlAwNDdLMzFNSk41tjRLNjI0s7BITDRONjMzSUpONDc2Tj7L4nP4LOuq1QVF-cUFqcklwHA8y5ZxVuYHAKwdnVD-BD5ey9st5oY&adroll_subnetwork=r&cpm=BF7A3904C10539BC&adroll_network=n&clickurl=http%3A//beacon-us-west.rubiconproject.com/beacon/rs/9a91d425-db49-41e4-9ebf-8640a3fcb94f/0/I7Vrj49xgSSRGnOClmMvdfOh8zs/%3Furl%3D) The time was 2:35 pm (GMT -5). ---
**Author:** ![Alley\_Dweller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/alley_dweller/32/430_2.png) [@Alley\_Dweller](https://boards.straightdope.com/u/Alley_Dweller)\ **Post date:** [July 16, 2016, 8:20pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/2 "2016-07-16T20:20:04Z")
Needless to say, Firefox does not distribute updates in this way. If anyone else sees this, don’t get fooled into downloading the update. ---
**Author:** ![Left\_Hand\_of\_Dorkness](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/left_hand_of_dorkness/32/7156_2.png) [@Left\_Hand\_of\_Dorkness](https://boards.straightdope.com/u/Left_Hand_of_Dorkness)\ **Post date:** [July 16, 2016, 8:34pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/3 "2016-07-16T20:34:36Z")
seems legit ---
**Author:** ![Digital\_is\_the\_new\_Analog](https://avatars.discourse-cdn.com/v4/letter/d/a88e4f/32.png) [@Digital\_is\_the\_new\_Analog](https://boards.straightdope.com/u/Digital_is_the_new_Analog)\ **Post date:** [July 17, 2016, 12:56am UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/4 "2016-07-17T00:56:55Z")
Backup detail: [Mozilla support page](https://support.mozilla.org/en-US/questions/1129758) specifically discussing this, and stating it’s not a real update. ---
**Author:** ![rsteer](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@rsteer](https://boards.straightdope.com/u/rsteer)\ **Post date:** [July 17, 2016, 1:31am UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/5 "2016-07-17T01:31:32Z")
I’ve seen this event two or three times in the past week or so. (The first time was at least a week ago.) This evening it happened when I was on a Walmart page, I believe. ---
**Author:** ![Superdude](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/superdude/32/13450_2.png) [@Superdude](https://boards.straightdope.com/u/Superdude)\ **Post date:** [July 17, 2016, 12:15pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/6 "2016-07-17T12:15:28Z")
Haven’t quite had that problem, but my company uses Firefox, and the SDMB shows up as malware to them, so I can only visit this site at home or on my phone. ---
**Author:** ![Siam\_Sam](https://avatars.discourse-cdn.com/v4/letter/s/d78d45/32.png) [@Siam\_Sam](https://boards.straightdope.com/u/Siam_Sam)\ **Post date:** [July 17, 2016, 2:29pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/7 "2016-07-17T14:29:17Z")
I use Firefox. This has not happened to me yet. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [July 17, 2016, 3:37pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/8 "2016-07-17T15:37:59Z")
> [@Digital\_is\_the\_new\_Analog](#): > > Backup detail: [Mozilla support page](https://support.mozilla.org/en-US/questions/1129758) specifically discussing this, and stating it’s not a real update. And even Mozilla are recommending you use Adblock (Well, uBlock Origin) to stop it. Sure, disable it on sites you trust that you want to support. But it’s one of the best forms of protection from malware and malvertisements for the average user. All the SDMB can do is tell their ad providers upstream that these guys are a problem. But it seems they are doing some tricks to make it harder to block them. ---
**Author:** ![aldiboronti](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@aldiboronti](https://boards.straightdope.com/u/aldiboronti)\ **Post date:** [July 17, 2016, 4:56pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/9 "2016-07-17T16:56:07Z")
Once again I thank the gods (and the developers of the software) for Noscript and Adblock Plus. ---
**Author:** ![Merneith](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Merneith](https://boards.straightdope.com/u/Merneith)\ **Post date:** [July 17, 2016, 5:24pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/10 "2016-07-17T17:24:46Z")
I use uBlock Origin and I’ve been very happy with it - Firefox: > **[uBlock Origin – Get this Extension for 🦊 Firefox (en-US)](https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/)** > > Download uBlock Origin for Firefox. Finally, an efficient wide-spectrum content blocker. Easy on CPU and memory. Chrome: > **[uBlock Origin](https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en)** > > Finally, an efficient blocker. Easy on CPU and memory. Always practice safe computing. ---
**Author:** ![Fir\_na\_tine](https://avatars.discourse-cdn.com/v4/letter/f/a587f6/32.png) [@Fir\_na\_tine](https://boards.straightdope.com/u/Fir_na_tine)\ **Post date:** [July 17, 2016, 8:22pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/11 "2016-07-17T20:22:26Z")
I’ve seen it a couple of times on facebook links. It’s not just SDMB that’s affected. ---
**Author:** ![gnoitall](https://avatars.discourse-cdn.com/v4/letter/g/bb73d2/32.png) [@gnoitall](https://boards.straightdope.com/u/gnoitall)\ **Post date:** [July 22, 2016, 3:08pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/12 "2016-07-22T15:08:03Z")
Yeah, I’m sure the vector is the advertising brokers both SDMB and Facebook are contracting with. Haven’t seen any attention from TPTB, alas. This can’t get fixed until the administration contacts the ad folks and makes 'em stop, per [this active unlocked ATMB sticky](http://boards.straightdope.com/sdmb/showthread.php?t=635028). OP, maybe you should post warning on that thread? Maybe that’s the one TPTB monitors. ---
**Author:** ![RivkahChaya](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rivkahchaya/32/8919_2.png) [@RivkahChaya](https://boards.straightdope.com/u/RivkahChaya)\ **Post date:** [July 22, 2016, 3:19pm UTC](https://boards.straightdope.com/t/malware-urgent-firefox-update/760074/13 "2016-07-22T15:19:34Z")
This has happened to me a couple of times as well. I use Firefox, and whenever it happened, I went to the Firefox site, and determined that I was using the most up-to-date version of Firefox, therefore, the pop-up must have been some kind of malware. Or at the very least clickbait of some sort. I have had a problem lately with script errors on the SDMB, which cause me to have to close the entire browser. I have the problem on my laptop and my tablet. I use a scriptblocker o the tablet, which stops about 90% of them, but I still have to close once in a while. The tablet has 8.1; laptop, 10, and the scriptblockers don’t seem to install well on the laptop, which I’m assuming is a not-ready-for-Win10 problem.