Trust Norton on this one, as you can see it's a highly questionable website address. For about a year there has been an active campaign of malware distribution using a new site every day with a stolen Firefox logo on an orange background. You are right to be skeptical. When you get a popup to save or cancel a download, Firefox has already started downloading the file to the Windows TEMP folder. Presumably that's why Norton is reporting a bad file even if you haven't acted on the dialog yet. So it's good news that the file was quarantined/deleted. More generally: To report a new malware distribution site, see: [[I found a fake Firefox update]]. To clean a system which got infected through a fake update or "patch", see: [[Troubleshoot Firefox issues caused by malware]]. (Start with Malwarebytes Anti-Malware) To minimize exposure to ad-driven malware redirects, consider an ad blocking extension such as: https://addons.mozilla.org/firefox/addon/ublock-origin/