RESOLVED - Firefox v31 - New Malware idea is BAD
-
- Posts: 10
- Joined: December 4th, 2013, 6:51 pm
RESOLVED - Firefox v31 - New Malware idea is BAD
I regulary use NirSoft programs, and I knwo they are ALL safe apps.
So, WHY DOES THE MALWARE BLOCKING IN FIREFOX 31 KEEP BLOCKING THE DOWNLOADS FROM THE NIRSOFT SITE?????????????
I am going to have to figure out how to COMPLETELY DISABLE THIS BS so I can use the sites I am used to using and downloading from STILL WORK RIGHT.
I KNOW they are safe, and apparently whomever runs the BLOCKLIST doesn't.
So, can someone tell me how COMPLETELY DISABLE this feature? I do NOT like it AT ALL.
Sorry if I am "yelling" here, but this is absolutely stupid just arbitrarily blocking a site I have used for QUITE a while.
So, WHY DOES THE MALWARE BLOCKING IN FIREFOX 31 KEEP BLOCKING THE DOWNLOADS FROM THE NIRSOFT SITE?????????????
I am going to have to figure out how to COMPLETELY DISABLE THIS BS so I can use the sites I am used to using and downloading from STILL WORK RIGHT.
I KNOW they are safe, and apparently whomever runs the BLOCKLIST doesn't.
So, can someone tell me how COMPLETELY DISABLE this feature? I do NOT like it AT ALL.
Sorry if I am "yelling" here, but this is absolutely stupid just arbitrarily blocking a site I have used for QUITE a while.
Last edited by CyberWolf2013 on July 23rd, 2014, 10:04 am, edited 2 times in total.
- DanRaisch
- Moderator
- Posts: 127234
- Joined: September 23rd, 2004, 8:57 pm
- Location: Somewhere on the right coast
Re: Firefox v31 - New Malware idea is BAD
What's the error message you are getting with that block?
Does the same thing occur if you launch the application in Mozilla Safe Mode? http://kb.mozillazine.org/Safe_mode
Does the same thing occur if you launch the application in Mozilla Safe Mode? http://kb.mozillazine.org/Safe_mode
-
- Posts: 10
- Joined: December 4th, 2013, 6:51 pm
Re: Firefox v31 - New Malware idea is BAD
When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..
Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.
So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.
Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.
So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.
-
- Posts: 5472
- Joined: May 13th, 2012, 10:43 am
Re: Firefox v31 - New Malware idea is BAD
CyberWolf2013 wrote:When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..
Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.
So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.
I'm curious , what is the link of the item you were trying to download that was blocked ?
- DanRaisch
- Moderator
- Posts: 127234
- Joined: September 23rd, 2004, 8:57 pm
- Location: Somewhere on the right coast
Re: Firefox v31 - New Malware idea is BAD
Just so you'll be clear, the list of sites to be blocked comes from Google and I don't believe the feature was added in Firefox 31 but has been there for some time. It's likely the site you're visiting was just added due to some problem which may have already been cleaned up. I had no problem downloading a text file from the site after reading your first post.
-
- Posts: 402
- Joined: September 26th, 2008, 2:13 am
- Location: South Carolina, USA
Re: Firefox v31 - New Malware idea is BAD
i wouldn't permanently disable the malicious-site-blocking.. (i want all the protection i can get)..
i tested, just now, and i had no problems with downloading programs from "nirsoft".. maybe something other than FF's malicious-site-blocking is blocking the downloads from "nirsoft"?
as for disabling the malicious-site-blocking, if you look in firefox's "options", you will see the option to disable the malicious-site-blocking, in "security"..
i tested, just now, and i had no problems with downloading programs from "nirsoft".. maybe something other than FF's malicious-site-blocking is blocking the downloads from "nirsoft"?
as for disabling the malicious-site-blocking, if you look in firefox's "options", you will see the option to disable the malicious-site-blocking, in "security"..
find answers at "Mozilla Support":
https://support.mozilla.org/en-US/products/firefox
https://support.mozilla.org/en-US/products/firefox
-
- Posts: 41
- Joined: May 18th, 2014, 3:05 am
Re: Firefox v31 - New Malware idea is BAD
DanRaisch wrote:Just so you'll be clear, the list of sites to be blocked comes from Google and I don't believe the feature was added in Firefox 31 but has been there for some time.
According to the 4th entry under "what's new" of the release notes ,there is a new feature, which will scan and block downloads, too:
https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc
before, only URLs got scanned and blocked. Now it seems like the downloads themselves can be blocked, too.
To turn off the new feature, but keep the old one for URLs only:
Replace browser.safebrowsing.appRepURL in about:config with an empty string. This disables application reputation checks but leaves other Safebrowsing malware protection intact.
edit:
redwolfe_98 wrote:as for disabling the malicious-site-blocking, if you look in firefox's "options", you will see the option to disable the malicious-site-blocking, in "security"..
I wouldn't do that, since it also disables the normal "malicious-site-blocking".
-
- Posts: 40
- Joined: May 28th, 2014, 5:32 pm
Re: Firefox v31 - New Malware idea is BAD
Has anyone looked into this new "feature" more in-depth? Apparently this is only enabled on Windows clients and here's a list of new items that potentially get uploaded to Google's server:
Yeah.
...the user-agent may perform a remote-lookup on Windows only...
When a binary file is downloaded, the user-agent extracts several pieces of metadata about the file, including:
- The target URL from which the file was downloaded, its referrer URL and any URLs in the redirect chain.
- The SHA-256 hash of the contents of the file.
- Any certificate verification information obtained through the Windows Authenticode APIs.
- The length of the file in bytes.
- The suggested filename for the download.
Yeah.
- therube
- Posts: 21714
- Joined: March 10th, 2004, 9:59 pm
- Location: Maryland USA
Re: Firefox v31 - New Malware idea is BAD
I doubt it is Safe Browsing causing the problem.
Doesn't FF have something (a Pref) that ties in with some Windows / A/V mechanism that "OK's" downloads?
Or it that IE?
Doesn't FF have something (a Pref) that ties in with some Windows / A/V mechanism that "OK's" downloads?
Or it that IE?
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
- dfoulkes
- Posts: 22525
- Joined: June 28th, 2008, 10:31 pm
- Location: Mesquite, Nevada
Re: Firefox v31 - New Malware idea is BAD
Is this what you're thinking of?
browser.download.manager.scanWhenDone
browser.download.manager.scanWhenDone
As you can see she's (The CAT) always alert and on the prowl for Meoware !!
-
- Posts: 10
- Joined: December 4th, 2013, 6:51 pm
Re: Firefox v31 - New Malware idea is BAD
the program i was downloading is called NirLauncher, it is an interface that will allow easier running of both NirSoft apps but also SysInternals as well. And the download also INCLUDES ALL of the NirSoft apps as well.
I have been using this app for QUITE some time, have scanned it with VirusTotal and even inquired about it on the sites I frequent, and it is CLEAN. 100% CLEAN.
Now, I do know that various AV clients and now apparently FF MISIDENTIFY it as supposedly malicious. IT IS NOT EVEN CLOSE TO MALICIOUS.
As I stated previous after changing the pref in about:config, I now have NO problems AT ALL in downloading PROPERLY.
FF should JUST STICK to "malicious URL's" only and NOT the file. And yes I have considered trying to get the ident for this changed so it is not blocked, but when you consider how long this program package has been around, and the AV vendors HAVE YET TO CORRECT THEIR STUPID PROGRAMS, I figure it to be a lost cause.
I am now also marking this as "RESOLVED" as it is for all intents and purposes is.
I have been using this app for QUITE some time, have scanned it with VirusTotal and even inquired about it on the sites I frequent, and it is CLEAN. 100% CLEAN.
Now, I do know that various AV clients and now apparently FF MISIDENTIFY it as supposedly malicious. IT IS NOT EVEN CLOSE TO MALICIOUS.
As I stated previous after changing the pref in about:config, I now have NO problems AT ALL in downloading PROPERLY.
FF should JUST STICK to "malicious URL's" only and NOT the file. And yes I have considered trying to get the ident for this changed so it is not blocked, but when you consider how long this program package has been around, and the AV vendors HAVE YET TO CORRECT THEIR STUPID PROGRAMS, I figure it to be a lost cause.
I am now also marking this as "RESOLVED" as it is for all intents and purposes is.
- therube
- Posts: 21714
- Joined: March 10th, 2004, 9:59 pm
- Location: Maryland USA
Re: RESOLVED - Firefox v31 - New Malware idea is BAD
> Is this what you're thinking of?
> browser.download.manager.scanWhenDone
Yes.
> browser.download.manager.scanWhenDone
Yes.
Fire 750, bring back 250.
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.19) Gecko/20110420 SeaMonkey/2.0.14 Pinball CopyURL+ FetchTextURL FlashGot NoScript
-
- Posts: 40
- Joined: May 28th, 2014, 5:32 pm
Re: RESOLVED - Firefox v31 - New Malware idea is BAD
Don't worry CyberWolf2013, this is just one of these update "surprises" that come along with the territory of using/updating firefox these days. From now on, be absolutely sure to carefully analyze the release notes before using an updated version of firefox so you know what you're getting yourself into. Thankfully this new "feature" can be easily disabled, unlike the google "search bar" in the new tab page.
-
- Posts: 5472
- Joined: May 13th, 2012, 10:43 am
Re: RESOLVED - Firefox v31 - New Malware idea is BAD
therube wrote:> Is this what you're thinking of?
> browser.download.manager.scanWhenDone
Yes.
That pref was removed in last couple of build cycles, but I can't find the bug that removed it... It could be that 31 does not have that pref anymore.
-
- Posts: 5472
- Joined: May 13th, 2012, 10:43 am
Re: Firefox v31 - New Malware idea is BAD
CyberWolf2013 wrote:When I try and DOWNLOAD a file that i s KNOWN GOOD from a KNOWN GOOD site I have used for QUITE a while, it says DOWNLOAD FAILED BECAUSE IT WAS BLOCKED..
Well, I can now report that I went into about:config, and per a very recent article about FF31 and it "new" features I found the entry:
browser.safebrowsing.appRepURL and cleared the URL listed there, then retried SAME file download....WORKED PERFECTLY, without FF interfering with it.
So, I hope if others have FF suddenly blocking KNOWN GOOD downloads just do the same and it will download correctly without FF playing an errant big brother or nanny, and OF COURSE getting it WRONG.
You should talk with Google, they are supplying the block-list for the suspect apps being blocked. I just tried downloading the NirLauncher with the latest Chrome dev version, and it also blocked the download as containing malicious items.