MozillaZine

RESOLVED - Firefox v31 - New Malware idea is BAD

User Help for Mozilla Firefox
CyberWolf2013
 
Posts: 10
Joined: December 4th, 2013, 6:51 pm

Post Posted July 23rd, 2014, 4:42 am

I regulary use NirSoft programs, and I knwo they are ALL safe apps.
So, WHY DOES THE MALWARE BLOCKING IN FIREFOX 31 KEEP BLOCKING THE DOWNLOADS FROM THE NIRSOFT SITE?????????????
I am going to have to figure out how to COMPLETELY DISABLE THIS BS so I can use the sites I am used to using and downloading from STILL WORK RIGHT.
I KNOW they are safe, and apparently whomever runs the BLOCKLIST doesn't.

So, can someone tell me how COMPLETELY DISABLE this feature? I do NOT like it AT ALL.

Sorry if I am "yelling" here, but this is absolutely stupid just arbitrarily blocking a site I have used for QUITE a while.


:furious:
Last edited by CyberWolf2013 on July 23rd, 2014, 10:04 am, edited 2 times in total.

DanRaisch
Moderator

User avatar
 
Posts: 122172
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Post Posted July 23rd, 2014, 4:52 am

What's the error message you are getting with that block?
Does the same thing occur if you launch the application in Mozilla Safe Mode? http://kb.mozillazine.org/Safe_mode

CyberWolf2013
 
Posts: 10
Joined: December 4th, 2013, 6:51 pm

Post Posted July 23rd, 2014, 5:16 am

When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..

Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.

So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.

TheVisitor
 
Posts: 4995
Joined: May 13th, 2012, 10:43 am

Post Posted July 23rd, 2014, 5:26 am

CyberWolf2013 wrote:When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..

Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.

So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.


I'm curious , what is the link of the item you were trying to download that was blocked ?

DanRaisch
Moderator

User avatar
 
Posts: 122172
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Post Posted July 23rd, 2014, 5:26 am

Just so you'll be clear, the list of sites to be blocked comes from Google and I don't believe the feature was added in Firefox 31 but has been there for some time. It's likely the site you're visiting was just added due to some problem which may have already been cleaned up. I had no problem downloading a text file from the site after reading your first post.

redwolfe_98
 
Posts: 259
Joined: September 26th, 2008, 2:13 am
Location: South Carolina, USA

Post Posted July 23rd, 2014, 5:30 am

i wouldn't permanently disable the malicious-site-blocking.. (i want all the protection i can get)..

i tested, just now, and i had no problems with downloading programs from "nirsoft".. maybe something other than FF's malicious-site-blocking is blocking the downloads from "nirsoft"?

as for disabling the malicious-site-blocking, if you look in firefox's "options", you will see the option to disable the malicious-site-blocking, in "security"..
find answers at "Mozilla Support":
https://support.mozilla.org/en-US/products/firefox

Foxus
 
Posts: 41
Joined: May 18th, 2014, 3:05 am

Post Posted July 23rd, 2014, 8:14 am

DanRaisch wrote:Just so you'll be clear, the list of sites to be blocked comes from Google and I don't believe the feature was added in Firefox 31 but has been there for some time.

According to the 4th entry under "what's new" of the release notes ,there is a new feature, which will scan and block downloads, too:
https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc

before, only URLs got scanned and blocked. Now it seems like the downloads themselves can be blocked, too.

To turn off the new feature, but keep the old one for URLs only:
Replace browser.safebrowsing.appRepURL in about:config with an empty string. This disables application reputation checks but leaves other Safebrowsing malware protection intact.


edit:
redwolfe_98 wrote:as for disabling the malicious-site-blocking, if you look in firefox's "options", you will see the option to disable the malicious-site-blocking, in "security"..

I wouldn't do that, since it also disables the normal "malicious-site-blocking".

choi_choi
 
Posts: 40
Joined: May 28th, 2014, 5:32 pm

Post Posted July 23rd, 2014, 8:44 am

Has anyone looked into this new "feature" more in-depth? Apparently this is only enabled on Windows clients and here's a list of new items that potentially get uploaded to Google's server:

...the user-agent may perform a remote-lookup on Windows only...

When a binary file is downloaded, the user-agent extracts several pieces of metadata about the file, including:
  1. The target URL from which the file was downloaded, its referrer URL and any URLs in the redirect chain.
  2. The SHA-256 hash of the contents of the file.
  3. Any certificate verification information obtained through the Windows Authenticode APIs.
  4. The length of the file in bytes.
  5. The suggested filename for the download.

Yeah.

therube

User avatar
 
Posts: 20061
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Post Posted July 23rd, 2014, 9:03 am

I doubt it is Safe Browsing causing the problem.

Doesn't FF have something (a Pref) that ties in with some Windows / A/V mechanism that "OK's" downloads?
Or it that IE?
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript

dfoulkes

User avatar
 
Posts: 22575
Joined: June 28th, 2008, 10:31 pm
Location: Mesquite, Nevada

Post Posted July 23rd, 2014, 9:55 am

Is this what you're thinking of?

browser.download.manager.scanWhenDone
As you can see she's (The CAT) always alert and on the prowl for Meoware !!

CyberWolf2013
 
Posts: 10
Joined: December 4th, 2013, 6:51 pm

Post Posted July 23rd, 2014, 10:03 am

the program i was downloading is called NirLauncher, it is an interface that will allow easier running of both NirSoft apps but also SysInternals as well. And the download also INCLUDES ALL of the NirSoft apps as well.
I have been using this app for QUITE some time, have scanned it with VirusTotal and even inquired about it on the sites I frequent, and it is CLEAN. 100% CLEAN.
Now, I do know that various AV clients and now apparently FF MISIDENTIFY it as supposedly malicious. IT IS NOT EVEN CLOSE TO MALICIOUS.
As I stated previous after changing the pref in about:config, I now have NO problems AT ALL in downloading PROPERLY.
FF should JUST STICK to "malicious URL's" only and NOT the file. And yes I have considered trying to get the ident for this changed so it is not blocked, but when you consider how long this program package has been around, and the AV vendors HAVE YET TO CORRECT THEIR STUPID PROGRAMS, I figure it to be a lost cause.

I am now also marking this as "RESOLVED" as it is for all intents and purposes is.

therube

User avatar
 
Posts: 20061
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Post Posted July 23rd, 2014, 11:16 am

> Is this what you're thinking of?
> browser.download.manager.scanWhenDone

Yes.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript

choi_choi
 
Posts: 40
Joined: May 28th, 2014, 5:32 pm

Post Posted July 23rd, 2014, 11:36 am

Don't worry CyberWolf2013, this is just one of these update "surprises" that come along with the territory of using/updating firefox these days. From now on, be absolutely sure to carefully analyze the release notes before using an updated version of firefox so you know what you're getting yourself into. Thankfully this new "feature" can be easily disabled, unlike the google "search bar" in the new tab page. ](*,)

TheVisitor
 
Posts: 4995
Joined: May 13th, 2012, 10:43 am

Post Posted July 23rd, 2014, 2:07 pm

therube wrote:> Is this what you're thinking of?
> browser.download.manager.scanWhenDone

Yes.


That pref was removed in last couple of build cycles, but I can't find the bug that removed it... It could be that 31 does not have that pref anymore.

TheVisitor
 
Posts: 4995
Joined: May 13th, 2012, 10:43 am

Post Posted July 23rd, 2014, 4:39 pm

CyberWolf2013 wrote:When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..

Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.

So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.


You should talk with Google, they are supplying the block-list for the suspect apps being blocked. I just tried downloading the NirLauncher with the latest Chrome dev version, and it also blocked the download as containing malicious items.

Return to Firefox Support


Who is online

Users browsing this forum: No registered users and 4 guests