This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Strange pop-up asking to download JavaScript File

more options

I'm using Firefox 47.0 and this is the second time I've been on a normal site (this time was walmart.com) that the screen turns into an ad for Firefox and a pop-up comes up asking me to save the file for "firefox-patch.js" The rest of the pop-up says "javaScript File (609 bytes) from oazeispettegola.net" I have malwarebytes and Norton installed on my computer, and neither scan shows anything. I'm guessing it's not an actual JavaScript installation, so if anyone has experienced this and can help me out, I'd really appreciate it.

I'm using Firefox 47.0 and this is the second time I've been on a normal site (this time was walmart.com) that the screen turns into an ad for Firefox and a pop-up comes up asking me to save the file for "firefox-patch.js" The rest of the pop-up says "javaScript File (609 bytes) from oazeispettegola.net" I have malwarebytes and Norton installed on my computer, and neither scan shows anything. I'm guessing it's not an actual JavaScript installation, so if anyone has experienced this and can help me out, I'd really appreciate it.

Chosen solution

It's malware. Unfortunately, once you release an image into the world, it can be used for evil (in violation of trademark law, but obviously they don't care).

If you downloaded that .js file:

Do not open it, it uses a Windows administrative script tool to install malware.

When you are using the downloads panel (the one attached to the toolbar button), be careful not to click anything as that may run it. Instead, right-click it and choose Open Containing Folder. That will launch a file window with the unwanted download highlighted, and then you can press the Delete key to send it to the Windows Recycle Bin.

If the download has already disappeared from the panel, the same mouse action works in the full download list (Ctrl+j or "Show All Downloads").

Read this answer in context 👍 1

All Replies (11)

more options

. Whenever you get a message / popup that software / files need to be updated;

DO NOT USE ANY OF THE PROVIDED LINKS

While this may be a legitimate message, it could also be Malware or a Virus. Any time you want or need to check for upgrades, go to the website of the True Owner of the program in question. For example, to check out Firefox, go to https://www.mozilla.org {web link}

You can report such a site at; Google Report Phishing Page {web link} which is the same when done while on site by going to Help > Report Web Forgery

Help us safeguard Mozilla’s trademarks by reporting misuse {web link}

more options

Seçilmiş Həll

It's malware. Unfortunately, once you release an image into the world, it can be used for evil (in violation of trademark law, but obviously they don't care).

If you downloaded that .js file:

Do not open it, it uses a Windows administrative script tool to install malware.

When you are using the downloads panel (the one attached to the toolbar button), be careful not to click anything as that may run it. Instead, right-click it and choose Open Containing Folder. That will launch a file window with the unwanted download highlighted, and then you can press the Delete key to send it to the Windows Recycle Bin.

If the download has already disappeared from the panel, the same mouse action works in the full download list (Ctrl+j or "Show All Downloads").

more options

If you ran the file, most likely Malwarebytes or Symantec's Kovter tool can clean it:

more options

Thanks guys! I thankfully didn't download anything, I just hit cancel instead of 'save file.' So is it just a random malware ad, or is it a sign that my computer is infected? Nothing else seems to indicate anything is wrong with the PC

more options

It's not you, it's the internet. Some ad blockers (or more specifically, some ad blocker filter sets) are preventing users from seeing these fake update pages, but other users may see them numerous times on particular sites.

more options

Oh I see. Thanks so much!

more options

I keep getting this page also. I've never downloaded anything from it. Is there any way to prevent this appearing? All I've been able to do is close the browser so I've lost where I was.

more options

This blocks that garbage for me: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

But using the Back button has worked for me when I was testing a version of Firefox that didn't use uBlock Origin - it allowed to go "back" to the page that sent me to the page with that garbage.

more options

Thanks for the link and information. I've tried the back button but it hasn't worked for me. I'll try the ad on.

more options

Maybe the .js variation of that exploit doesn't "go back", I forgot to mention that my experimentation happened before we started hearing about the .js file being "offered".

more options

Sometimes using Back triggers a new load of the page you just left. In that case, it often helps to right-click the Back button and go further back in history.