supposably false positive

[bluesteftward]

file "user.js" from Privacy-Handbuch (= just an config-addition to a firefox-profile)
https://www.privacy-handbuch.de/handbuch_21u.htm
result virustotal.com: 0/52
https://www.virustotal.com/de/file/b94bf848d9ee3d1d2e13ac2dfa9bf32af47d31207a29e9a5484bb5ea3b03ab72/analysis/1486621004/

file + mbam-log attached.

false_.zip

[miekiemoes]

Hi,

This isn't a false positive. We are alerting here for a potentially Unwanted Modification.

In your case, it looks like you have your user.js override the default settings in firefox where some default security measurements have been disabled.

Eg, in your case, the safebrowsing protection has been disabled via your user.js file. This is something that is often done by malware as well, hence why we need to alert the user here.

Unsure if you are aware of this though - but it's not good practice to have the safebrowsing features in Firefox disabled (in your case override via your user.js file).

https://support.mozilla.org/t5/Protect-your-privacy/How-does-built-in-Phishing-and-Malware-Protection-work/ta-p/9395

 

In either way, if you are aware of this, then add this detection to your exclusions.

 

Thanks!

Edited February 9, 2017 by miekiemoes

[bluesteftward]

No!
"add this detection to exclusions" - is not the problem.
If you you've read a little bit more careful, ;)
you've recognized, that the mentioned site ("www.privacy-handbuch.de"), even it's a german site, first of all deals with questions of security in internet!
One of the authors has been part of JonDoNym, next to torbrowser one of the only projects dealing explicitly with security in internet!
And that's source of the given file "user.js". It's (only) an addition(!) to a normal mozilla-firefox-profile! This addition is totally harmless - that's not difficult to detect. The addition is only a collection of configuration-steps to get a privacy-friendly firefox-profile (https://www.privacy-handbuch.de/handbuch_21u.htm)!! To avoid that a user has to add these steps manual via 'about:config' he/she can copy the file 'user.js' into the wanted firefox-profile. That's it!

=> so the alert of your program is redundant and in the end it's wrong.

[miekiemoes]

Hi,

To elaborate more on this...

The browser settings in the user.js file actually overrides the settings in the prefs.js - so this isn't really an addition, since it overrides.

Some more info: http://miekiemoes.blogspot.be/2009/01/settings-wont-save-in-firefox.html

The safebrowsing feature in Firefox is actually google's safebrowsing one, which was implemented by default in Firefox since 2007. If not mistaken, this isn't present anymore in latest builds of Firefox however and replaced with the Safe Browsing API rather if not mistaken.

In this user.js file, it has settings that disables the safebrowsing feature of your Firefox browser as it has the value to "false" set here.

To give some examples what's in this user.js file:

user_pref("browser.safebrowsing.downloads.enabled", false);

user_pref("browser.safebrowsing.malware.enabled", false);

user_pref("browser.safebrowsing.enabled", false);

So this means, when these settings are present in the prefs.js file as well and set as true (as how it should), the presence of your user.js file will override this.

We've seen malware creating such user.js file as well, exactly with above preferences also set to false. I know the goal of yours is rather for anonimity/privacy reasons.

In either way, since our engine can't know whether this is a user.js file set by malware that disables safebrowsing, or a user.js file that is set by the user himself, we believe we need to alert here still as Potentially Unwanted Modification. We are not saying it's malware, we are alerting that default settings to use safebrowsing have been disabled. So in this case, it's users choice to either have Malwarebytes deal with this, or ignore.

 

Edited February 10, 2017 by miekiemoes