Firefox "this file contains a virus or malware"

[Enjay]

I just thought that it might be worth mentioning this here. In the last week or so, I (and many others across teh intarwebs) have been getting the message "this file contains a virus or malware" when downloading files using Firefox.

Basically, you click a link to download a file, but the download icon in the toolbar shows a red dot beside it, and when you click on that, you see the message (and you have the option to download anyway at that point).

This is due to Firefox's built-in Phishing and Malware Protection (which Mozilla reminded us all about proudly in a recent update), and it's being over-zealous. A user on Reddit suggested that it is due to Firefox using Google's malware database - and called into question the accuracy and updatedness of that database. Part of this is that it will flag certain sites as suspicious sources, or if you download a file that not many others have, it may not yet be registered as a clean file etc. It's why you might find a file blocked from one site, but the exact same file is apparently fine from another source, or why you might have a download blocked, only to find it working a while later once the database knows about it. I don't know the precise details, but the point is, Firefox (perhaps because of this database) is flagging a lot of safe files as unsafe. Whether other browsers do something similar with this database, I can't say.

In recent days, I've downloaded several game mods (for Doom and other games - including files posted as links from here) where there is absolutely no way the content would have a virus in it, but Firefox has still flagged the file with "this file contains a virus or malware". It has happened frequently enough for me that I have disabled the function in Firefox's settings. I have virus protection which auto-checks everything I download anyway, and if I have the slightest doubt about any file, I also instruct it to explicitly check the file and I may also use the VirusTotal website as a belt-and braces check. I don't need another checker, and I certainly don't need one that throws up frequent false positives and thereby makes it difficult to access legitimate downloads.

Unsurprisingly to me, every single file that Firefox has flagged as unsafe has got a clean bill of health from my virus checker and VirusTotal.

So, this post is just to spread the word that Firefox is doing this and, if you get a message like this, obviously proceed with caution and double-check the file, but chances are there's nothing wrong with it. Every now and again, someone reports on here that their computer (by whatever means) has flagged a file as containing a virus. They are almost always a false positive. So, with Firefox doing this at the moment, chances are this will become more likely.

[Rachael]

Thank you for pointing that out Enjay.

It doesn't help that Google has become increasingly hostile towards its users lately, especially people who use adblockers (which, ironically, actually *help* protect against viruses more often than not!), but it obviously never ended there, and Google's services have been declining as a result. In fact, this site had to switch away from ReCaptcha (another Google service) because of the problems that it was causing.

[Enjay]

Google's hostility to ad blockers is one of the reasons I prefer Firefox. I totally get that it's their revenue stream, but when it goes too far and a site becomes unusable because of massively intrusive adverts taking over a page, and where those adverts could be a vector for something not just annoying but harmful, then something needs to be done. If it isn't being done at source, then I will do it myself.

[Redneckerz]

Life long user of Firefox, even though i use Chrome at work. Haven't had this message yet, but still, thanks for the headsup!

[Enjay]

I guess it depends on what you have been downloading, and from where. From my observations, it tends to be files from the less well known file hosting sites that often get flagged. Stuff coming from file.io has been flagged more often than other hosting sites (at least in my experience).

Nexus mods is in interesting one. I have downloaded a few files very shortly after someone uploaded them and got the warning. If I give it half an hour, I guess the file has become known because it no longer flags up as a problem. Of course, that has usually been long enough for a few people to download it and then report the file as suspicious.