Why are recent Firefox (for Windows) downloads ALL being found to contain ransomware?
Paul Kosinski via clamav-users <[email protected]> Thu, 26 Mar 2026 10:16:15 -0400
| Newsgroups | gmane.comp.security.virus.clamav.user |
|---|---|
| Organization | InterMedia Enterprises |
| Message-ID | <[email protected]> |
For example: Firefox Setup 140.9.0esr.exe --> Win.Trojan.Spora-7724442-0 FOUND Firefox Setup 115.34.0esr.exe --> Win.Trojan.Spora-7724442-0 FOUND Firefox Setup 115.34.0esr.msi --> Win.Trojan.Spora-7724442-0 FOUND These are from ClamAV 1.0.9 clamd on Linux receiving file to be scanned over TCP. Typical output: ==================== Firefox Setup 115.34.0esr.exe: Win.Trojan.Spora-7724442-0 FOUND ----------- SCAN SUMMARY ----------- Infected files: 1 Time: 36.458 sec (0 m 36 s) Start Date: 2026:03:26 10:03:00 End Date: 2026:03:26 10:03:37 RC = 1 ==================== _______________________________________________ Manage your clamav-users mailing list subscription / unsubscribe: https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/Cisco-Talos/clamav-documentation https://docs.clamav.net/#mailing-lists-and-chat