This site will have limited functionality while we undergo maintenance to improve your experience. If an article doesn't solve your issue and you want to ask a question, we have our support community waiting to help you at @FirefoxSupport on Twitter and/r/firefox on Reddit.

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Viruses in C:\program files\Mozilla Firefox

more options

My Norton virus detection software regularly finds viruses and Trojan horses in the directory: C:\program files\Mozilla Firefox Why?

It seem to happen after using Facebook or more often Craigslist. I tried putting a read only attribute on this directory, but it still happens.

Norton then requires a reboot. So it is a hassle.

Does anyone have any ideas as to what is going on?

My Norton virus detection software regularly finds viruses and Trojan horses in the directory: C:\program files\Mozilla Firefox Why? It seem to happen after using Facebook or more often Craigslist. I tried putting a read only attribute on this directory, but it still happens. Norton then requires a reboot. So it is a hassle. Does anyone have any ideas as to what is going on?

All Replies (4)

more options

joe_raftery said

My Norton virus detection software regularly finds viruses and Trojan horses in the directory: C:\program files\Mozilla Firefox Why?

Just searching your question, I found this. You should try posting your question here since it's Norton giving you the message. https://community.norton.com/en/forums/trojan-horse-detected-0

I am curious to see what file(s) Norton is flagging as bad and what's the path to the files. Post a screenshot.

more options

I wouldn't expect the program directory to change as you browse, unlike your active profile folder (website storage databases, web content cache). Does the software mention any specific files that it finds objectionable?

more options

jscher2000 Thank you for your thoughtful input.

jscher2000 - wrote

"I wouldn't expect the program directory to change as you browse, unlike your active profile folder (website storage databases, web content cache). Does the software mention any specific files that it finds objectionable?"

I agree. Specific files? Good question!

It seems that Norton renames the file to the "name/number" they assign the virus.

Ex: Filename: Trojan Horse Full Path: c:\program files\mozilla firefox\00031159.tmp

The virus/trojan seem to use Mozilla to escalate privilege to write to a read-only directory.

more options

There is a new version of Firefox ESR out this week. I don't know whether installing it will make any difference, but you could try.

https://www.mozilla.org/en-US/firefox/115.8.0/releasenotes/

https://www.mozilla.org/en-US/firefox/all/#product-desktop-esr