Do you recall the sequence of events leading up to the message? For example, had you just loaded a new page or started some new Flash media? I think most likely it was something along those lines which triggered Firefox to make the request to the blocked site.

Thank you.

Nothing new.

Don't use flash (well youtube - but not recently). Detected by Malware Bytes, which I trust not to be false positive (malware valided by Succuri (link in my original post).

Malware Bytes Screenshot attached

If it wasn't a site you visited causing it, it could be one of your extensions. Something is triggering that request.

Thought about that - nothing new there either. Ghostery is the newest... about 2 months old.

Started to disable extensions, but then realized that some need heavy configuration (did a lot of stuff to look & act like old FF).

my concern is that the malware is tied to ff.exe

If you think Firefox program files are suspect, then:

Clean Reinstall

We use this name, but it's not about removing your settings, it's about making sure the program files are clean (no inconsistent or alien code files). As described below, this process does not disturb your existing settings. Do NOT uninstall Firefox, that's not needed.

It only takes a few minutes.

(A) Download a fresh installer for Firefox 48.0 from https://www.mozilla.org/firefox/all/ to a convenient location. (Scroll down to your preferred language.) For maximum plugin compatibility, choose the 32-bit version.

(B) Exit out of Firefox (if applicable).

(C) Using Windows Explorer/My Computer, rename the program folder as follows:

C:\Program Files (x86)\Mozilla Firefox

to

C:\Program Files (x86)\OldFirefox

(D) Run the installer you downloaded in step (A). It should automatically connect to your existing settings.

Note: Some plugins may exist only in that OldFirefox folder. If something essential is missing, look in these folders:

• \OldFirefox\Plugins
• \OldFirefox\browser\plugins

Any improvement?

Thanks for your help. Will do the reinstall. Hmmm... I'm on v47. I will update first and then reboot in "FF Safe Mode" (addons disabled) Will report results when done.

updated to v48 - Domain, 42.236.74.247, js.users.51.la still there rebooted in safe mode - Domain, 42.236.74.247, js.users.51.la still there.

Need to do more testing prior to clean install.

Just tested in IE11 and Google Chrome. Problem does not exist.

Does exist in Firefox 48 with and without add ons.

Will now try clean install.

Just found (I think) the source issue.

google new tab shows list of previously visited websites - which I had deleted one by one. EXCEPT, there was one more that had no thumbnail, so was not deleted.

I deleted that site from the google search history and the js.users.51.la link disappeared.

Let's mark this one as "solved". I will reopen if it recurrs.

In the meantime, I will advise the website owner of their apparent problem.

What is the google new tab -- do you mean Firefox's built-in new tab page?

In that case, yes, Firefox may make a background request to try to generate a missing thumbnail. That can have strange consequences, as in:

Why does another application launch when I open a new tab? Plug-in is in Firefox and I can't get ride of it.

You are correct:

Firefox displays website links as thumbnails (miniaturized images) or logos on the New Tab page.

See 2 screenshots.

Neil