RESOLVED - Firefox v31 - New Malware idea is BAD

User Help for Mozilla Firefox
CyberWolf2013
Posts: 10
Joined: December 4th, 2013, 6:51 pm

RESOLVED - Firefox v31 - New Malware idea is BAD

Post by CyberWolf2013 »

I regulary use NirSoft programs, and I knwo they are ALL safe apps.
So, WHY DOES THE MALWARE BLOCKING IN FIREFOX 31 KEEP BLOCKING THE DOWNLOADS FROM THE NIRSOFT SITE?????????????
I am going to have to figure out how to COMPLETELY DISABLE THIS BS so I can use the sites I am used to using and downloading from STILL WORK RIGHT.
I KNOW they are safe, and apparently whomever runs the BLOCKLIST doesn't.

So, can someone tell me how COMPLETELY DISABLE this feature? I do NOT like it AT ALL.

Sorry if I am "yelling" here, but this is absolutely stupid just arbitrarily blocking a site I have used for QUITE a while.


:furious:
Last edited by CyberWolf2013 on July 23rd, 2014, 10:04 am, edited 2 times in total.
User avatar
DanRaisch
Moderator
Posts: 127188
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Re: Firefox v31 - New Malware idea is BAD

Post by DanRaisch »

What's the error message you are getting with that block?
Does the same thing occur if you launch the application in Mozilla Safe Mode? http://kb.mozillazine.org/Safe_mode
CyberWolf2013
Posts: 10
Joined: December 4th, 2013, 6:51 pm

Re: Firefox v31 - New Malware idea is BAD

Post by CyberWolf2013 »

When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..

Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.

So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.
TheVisitor
Posts: 5469
Joined: May 13th, 2012, 10:43 am

Re: Firefox v31 - New Malware idea is BAD

Post by TheVisitor »

CyberWolf2013 wrote:When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..

Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.

So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.


I'm curious , what is the link of the item you were trying to download that was blocked ?
User avatar
DanRaisch
Moderator
Posts: 127188
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Re: Firefox v31 - New Malware idea is BAD

Post by DanRaisch »

Just so you'll be clear, the list of sites to be blocked comes from Google and I don't believe the feature was added in Firefox 31 but has been there for some time. It's likely the site you're visiting was just added due to some problem which may have already been cleaned up. I had no problem downloading a text file from the site after reading your first post.
redwolfe_98
Posts: 402
Joined: September 26th, 2008, 2:13 am
Location: South Carolina, USA

Re: Firefox v31 - New Malware idea is BAD

Post by redwolfe_98 »

i wouldn't permanently disable the malicious-site-blocking.. (i want all the protection i can get)..

i tested, just now, and i had no problems with downloading programs from "nirsoft".. maybe something other than FF's malicious-site-blocking is blocking the downloads from "nirsoft"?

as for disabling the malicious-site-blocking, if you look in firefox's "options", you will see the option to disable the malicious-site-blocking, in "security"..
find answers at "Mozilla Support":
https://support.mozilla.org/en-US/products/firefox
Foxus
Posts: 41
Joined: May 18th, 2014, 3:05 am

Re: Firefox v31 - New Malware idea is BAD

Post by Foxus »

DanRaisch wrote:Just so you'll be clear, the list of sites to be blocked comes from Google and I don't believe the feature was added in Firefox 31 but has been there for some time.

According to the 4th entry under "what's new" of the release notes ,there is a new feature, which will scan and block downloads, too:
https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc

before, only URLs got scanned and blocked. Now it seems like the downloads themselves can be blocked, too.

To turn off the new feature, but keep the old one for URLs only:
Replace browser.safebrowsing.appRepURL in about:config with an empty string. This disables application reputation checks but leaves other Safebrowsing malware protection intact.


edit:
redwolfe_98 wrote:as for disabling the malicious-site-blocking, if you look in firefox's "options", you will see the option to disable the malicious-site-blocking, in "security"..

I wouldn't do that, since it also disables the normal "malicious-site-blocking".
choi_choi
Posts: 40
Joined: May 28th, 2014, 5:32 pm

Re: Firefox v31 - New Malware idea is BAD

Post by choi_choi »

Has anyone looked into this new "feature" more in-depth? Apparently this is only enabled on Windows clients and here's a list of new items that potentially get uploaded to Google's server:

...the user-agent may perform a remote-lookup on Windows only...

When a binary file is downloaded, the user-agent extracts several pieces of metadata about the file, including:
  1. The target URL from which the file was downloaded, its referrer URL and any URLs in the redirect chain.
  2. The SHA-256 hash of the contents of the file.
  3. Any certificate verification information obtained through the Windows Authenticode APIs.
  4. The length of the file in bytes.
  5. The suggested filename for the download.

Yeah.
User avatar
therube
Posts: 21703
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Re: Firefox v31 - New Malware idea is BAD

Post by therube »

I doubt it is Safe Browsing causing the problem.

Doesn't FF have something (a Pref) that ties in with some Windows / A/V mechanism that "OK's" downloads?
Or it that IE?
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
User avatar
dfoulkes
Posts: 22525
Joined: June 28th, 2008, 10:31 pm
Location: Mesquite, Nevada

Re: Firefox v31 - New Malware idea is BAD

Post by dfoulkes »

Is this what you're thinking of?

browser.download.manager.scanWhenDone
As you can see she's (The CAT) always alert and on the prowl for Meoware !!
CyberWolf2013
Posts: 10
Joined: December 4th, 2013, 6:51 pm

Re: Firefox v31 - New Malware idea is BAD

Post by CyberWolf2013 »

the program i was downloading is called NirLauncher, it is an interface that will allow easier running of both NirSoft apps but also SysInternals as well. And the download also INCLUDES ALL of the NirSoft apps as well.
I have been using this app for QUITE some time, have scanned it with VirusTotal and even inquired about it on the sites I frequent, and it is CLEAN. 100% CLEAN.
Now, I do know that various AV clients and now apparently FF MISIDENTIFY it as supposedly malicious. IT IS NOT EVEN CLOSE TO MALICIOUS.
As I stated previous after changing the pref in about:config, I now have NO problems AT ALL in downloading PROPERLY.
FF should JUST STICK to "malicious URL's" only and NOT the file. And yes I have considered trying to get the ident for this changed so it is not blocked, but when you consider how long this program package has been around, and the AV vendors HAVE YET TO CORRECT THEIR STUPID PROGRAMS, I figure it to be a lost cause.

I am now also marking this as "RESOLVED" as it is for all intents and purposes is.
User avatar
therube
Posts: 21703
Joined: March 10th, 2004, 9:59 pm
Location: Maryland USA

Re: RESOLVED - Firefox v31 - New Malware idea is BAD

Post by therube »

> Is this what you're thinking of?
> browser.download.manager.scanWhenDone

Yes.
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
choi_choi
Posts: 40
Joined: May 28th, 2014, 5:32 pm

Re: RESOLVED - Firefox v31 - New Malware idea is BAD

Post by choi_choi »

Don't worry CyberWolf2013, this is just one of these update "surprises" that come along with the territory of using/updating firefox these days. From now on, be absolutely sure to carefully analyze the release notes before using an updated version of firefox so you know what you're getting yourself into. Thankfully this new "feature" can be easily disabled, unlike the google "search bar" in the new tab page. ](*,)
TheVisitor
Posts: 5469
Joined: May 13th, 2012, 10:43 am

Re: RESOLVED - Firefox v31 - New Malware idea is BAD

Post by TheVisitor »

therube wrote:> Is this what you're thinking of?
> browser.download.manager.scanWhenDone

Yes.


That pref was removed in last couple of build cycles, but I can't find the bug that removed it... It could be that 31 does not have that pref anymore.
TheVisitor
Posts: 5469
Joined: May 13th, 2012, 10:43 am

Re: Firefox v31 - New Malware idea is BAD

Post by TheVisitor »

CyberWolf2013 wrote:When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..

Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.

So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.


You should talk with Google, they are supplying the block-list for the suspect apps being blocked. I just tried downloading the NirLauncher with the latest Chrome dev version, and it also blocked the download as containing malicious items.
Post Reply