R3dfox detected as ransomware on Avast

realsaturos · Unread post by **realsaturos** » 20 Dec 2025, 18:44

Hello,

I am using R3dfox 144.0.2, downloaded from https://github.com/Eclipse-Community/r3dfox/releases

After r3dfox is running a while Avast recognizes it as ransomware, because i tries to modify "desktop.ini" in the users documents folder.

I am using Windows 7 64-Bit.

a screenshot of the avast message is attached.

Does anyone know why r3dfox.exe is trying to modify the desktop.ini file?

PS: I did already send r3dfox.exe and its setup installer to avast for false positive check, a week ago, but it is still not resolved.

Unread post by **Duke** » 20 Dec 2025, 19:20

realsaturos wrote: ↑20 Dec 2025, 18:44 I am using R3dfox 144.0.2, downloaded from https://github.com/Eclipse-Community/r3dfox/releases
After r3dfox is running a while Avast recognizes it as ransomware, because i tries to modify "desktop.ini" in the users documents folder.
I am using Windows 7 64-Bit.

Does anyone know why r3dfox.exe is trying to modify the desktop.ini file?

That doesn't happen to me on Windows 8.1.
Do you save your downloads to the documents folder ? It might also be some extension.

realsaturos · Unread post by **realsaturos** » 20 Dec 2025, 20:25

Hello Duke,

it happens on a completely fresh r3dfox installation.

I did not install any extension, and the Download Folder inside r3dfox settings is the default: C:\users\username\Downloads

Unread post by **Duke** » 20 Dec 2025, 21:48

Looks like it's a known Firefox issue:

https://bugzilla.mozilla.org/show_bug.cgi?id=1948976

https://connect.mozilla.org/t5/discussions/does-firefox-ever-write-to-logged-in-users-documents-folder/td-p/97020
https://connect.mozilla.org/t5/discussions/firefox-134-0-blocked-by-defender-needs-controlled-folder-access/m-p/94265

Eclipse Community