How to identify what Virus scanner Firefox is using on downloads
Hi, I am experiencing a problem that numerous people have raised issue with on the internet, but none that I can see have found a decent answer. Firefox download manager shows a file is downloading, does the virus scan on the downloaded item, and then when you right click to open the item or go to where it has been saved, these options are greyed out. The same issue exists in internet explorer, so this is not specifically a Firefox issue. The issue seems to be that the selected virus scanner is identifying everything (and I mean everything), that is downloaded, as containing a virus, and deletes it after download. Various solutions have been offerered, such as uninstalling virus scanners, such as AVG, running virus scanners and mailware scanners, such as Mailwarebytes, and Spybot Search and Destroy; and I have done all of these. I have uninstalled Zone Alarm, I have uninistalled AVG, and I have run the various apps suggested. None have fixed the problem. The only way round it I have found is to go to About:Config and toggle the browser.download.manager.scanWhenDone value to False, and I can then download again. I believe some how the scanner that this setting is finding is corrupt, but because I have already removed all virus scanners from my PC, I am wondering what Firefox is finding to use as a scanner when the toggled value is True. I've uninstalled them all, so what is it using, and how can I find out? Perhaps it is a trojan or something that is prettending to be a virus scanner and is blocking all my downloads. Please can some effort be put into solving this issue as there are a large number of posts about it and people switching from Firefox to Google Chrome, which seems immune from the issue. I prefer to continue using Firefox so would like to see this solved. It is not Firefox that is at fault, simply it and IE are picking up some dud virus scanner. Thanks Stephen
All Replies (3)
Generally speaking, most antivirus software should have real-time virus scanning turned on for all file writes including Firefox downloads. At the time this feature was added, a larger number of users may have been using freeware AV that only ran on request, but due to competitive pressure, I think even most freeware AV now includes real-time scanning. So having Firefox trigger a scan should be unnecessary in most cases.
What's strange about your experience is that it appears not to matter what the file type is - JPEG, PDF, ZIP, MSI, EXE. Even if certain download are becoming corrupted/infected/trojanized, you would not expect all file formats to be equally affected. Similarly, the Windows policy block (IE Internet Zone settings) usually applies only to executables.
As for the scanner Firefox is using, it should be your active AV software listed in the Windows Control Panel "Action Center". Without delving into Firefox's source code, I'm not sure what registry key or other source Firefox consults for that information.
Interestingly enough, when AVG Free was installed as the active anti-virus program, Windows Control Panel "Action Center" would not list it, it said there was no anti-virus and suggested I needed to get one. On re-installing the latest AVG free, still it said I had no anti-virus installed.
There are loads of people posting commentary about this issue, and some of the answers are giving links, possibly to malicious software, although that is not a problem while everything is reported as containing a virus and deletes automatically. There is a worry that someone may use another PC to get the software and find they corrupt two PC's in the process. It would be really nice if Mozilla could find the route cause.
From the last sentence of your original post, it sounds as though you have the same or similar issue in IE. Is that correct?
Could you research the following on your system related to Windows Policy checking?
(1) Setting for "Launching applications and unsafe files" in the Internet Zone
You can access this either from within IE (Tools > Internet Options) or from the Windows Control Panel (Internet Options). On the Security tab, highlight Internet and click Custom Level. Scroll down about 60% of the way into the Miscellaneous section. If the setting is "Disable" that will trigger cancellation for executables. However, it is not supposed to affect other types of files.
You could set this to Prompt and see whether that helps. Firefox might need to be restarted before it takes effect.
(2) Registry settings - the following key does not exist by default:
HKEY_CURRENT_USER\ Software\Microsoft\Windows\CurrentVersion\Policies\Associations
If you have it:
Do you have a value named DefaultFileTypeRisk? If so, delete it to use the default behavior.
Do you have a value named HighRiskFileTypes? If so, what file extensions are listed? Corporate IT may create this value.
Do you have a value named LowRiskFileTypes? Malware may create this value to bypass security restrictions.
Windows might need to be restarted before any changes takes effect, or maybe just IE and Firefox.