Win10 media creation tool download blocked, MB for Firefox

[nukecad]

[John L. Galt]

Odd.  I just went to https://www.microsoft.com/en-us/software-download/windows10 and I was able to click both the Upgrade now link as well as the Download tool now link without triggering the MB addon.

[nukecad]

The Upgrade now link is fine and runs the update assistant.

The Download tool now starts the download OK, but the MB block triggers when you actually try to 'save file' from the pop-up box.

It's the file download that is being blocked not the page.

(I had previously reported the same with a CCleaner download, all looked fine until you hit the 'Save file' button, at which point MB for Firefox threw up the block).

PS. I note that someone has moved this thread to the beta sub-forum. - When I asked last week we were told by Devin to put false positives in the main FP sub-forum.
Could someone clarify where you require FP's for this beta to be posted?

 

Edited May 2, 2018 by nukecad

[Zynthesist]

@nukecad You are reporting a block by the FF browser extension correct? 

[Zynthesist]

Not sure what version you have but I was able to download it via the "Download tool now" link and save in FF with extension Version 1.0.16

[John L. Galt]

5 hours ago, nukecad said:

The Upgrade now link is fine and runs the update assistant.

The Download tool now starts the download OK, but the MB block triggers when you actually try to 'save file' from the pop-up box.

It's the file download that is being blocked not the page.

(I had previously reported the same with a CCleaner download, all looked fine until you hit the 'Save file' button, at which point MB for Firefox threw up the block).

PS. I note that someone has moved this thread to the beta sub-forum. - When I asked last week we were told by Devin to put false positives in the main FP sub-forum.
Could someone clarify where you require FP's for this beta to be posted?

I should have clarified - I not only clicked each link but was able to download each tool without an issue.

 

[nukecad]

Fair enough it may be acting differently for each of us.

But as the screenshot in my OP clearly shows it was blocked for me.

Isn't the whole point of of a beta - to find out what may or may not be a problem?

I've just tried it again and get exactly the same block when trying to download the Media creation tool, I would post another screenshot but it's the same as in my OP.

Windows 10 home, v1803, build 17034.1

[John L. Galt]

1 minute ago, nukecad said:

Fair enough it may be acting differently for each of us.

But as the screenshot in my OP clearly shows it was blocked for me.

Isn't the whole point of of a beta - to find out what may or may not be a problem?

I've just tried it again and get exactly the same block when trying to download the Media creation tool, I would post another screenshot but it's the same as in my OP.

Windows 10 home, v1803, build 17034.1

Exactly,  And thus you need multiple points of data to help eliminate causality.  Since it works for me and doesn't work for you, there is now a baseline to show that it does work as intended, when it is supposed to - but something is not 100% correct int he addon so it is sometimes triggering a block when it should not.

[nukecad]

I am very aware that this is a beta extension for the browser, and I am willing to help refining it.

When I am posting about this beta I try to make this very clear so as not to confuse it with the mainstream product.

I am trying to make this clear by putting "MB for Firefox" in the post title and posting screenshots that clearly say at the top "Malwarebytes for Firefox (beta)".

If I could be doing anything more to flag that I am reporting someting that the beta is doing then please advise.

 

[John L. Galt]

To me it looks like you covered all your bases perfectly fine

[nukecad]

Thanks John,

It's still a bit of a 'here or there' on where to report FP's for the Firefox (or Chrome) extension beta.

Until someone says otherwise I will put any FP's in the FP thread, noting with a screenshot that it is the Firefox beta extension that threw them up.

If they keep getting moved to here then I'll change.

I suspect there may be another problem if/when I hit the upload limit for posting images of the screenshots, but I'll just delete the old ones as they will no longer be needed.

[rakka]

Since Browser Extension is a beta program, all FP's should be reported here https://forums.malwarebytes.com/forum/242-malwarebytes-for-firefox

I am the direct contact point for all the Browser Extension issues, you can PM me your issues as well.

anyone above still having issue with Microsoft downloads? 

[nukecad]

5 hours ago, rakeshsejwal said:

Since Browser Extension is a beta program, all FP's should be reported here https://forums.malwarebytes.com/forum/242-malwarebytes-for-firefox

I am the direct contact point for all the Browser Extension issues, you can PM me your issues as well.

anyone above still having issue with Microsoft downloads? 

Thanks for the clarification/update Rakesh,

I had previously been advised to post them in the main FP forum,
https://forums.malwarebytes.com/topic/227697-where-to-post-fps/
It does make sense to post them here though so as not to confuse things with the mainstream MB3.

 

As for the Media Creaton Tool, yes the download is still being blocked for me.
Again it's when you come to 'Save File' that the block gets thrown up.

Windows 10 home, v1803, build 17134.1 (PS. I'm not sure if that build has changed or if I just mistyped it in my earlier post?)
Firefox v59.0.3 (64-bit)

I'm now on v1.0.20 of the extension, and so the blocking page has changed, here's a screenshot taken a few minutes ago:

Interestingly I also note that this blocked download was from "...www.microsoft.com/en-gb/..." whereas my previous screeshot (above) was "...www.microsoft.com/en-us/..."

Edited May 9, 2018 by nukecad

[rakka]

@nukecad

can you please collect the console logs for me? 

how to? https://developer.mozilla.org/en-US/docs/Tools/Browser_Console

[nukecad]

Not at home at the moment but I'll give it attention later.

Cheers.

[nukecad]

@rakeshsejwal

Sorry, but I'm lost with that console log at the moment. (I'm a user not a developer).

Give me some time to work it out.

I will probably be a few hours until I can respond, it's 23:14 here and I want some food and some sleep.

[nukecad]

On 09/05/2018 at 6:28 PM, rakeshsejwal said:

can you please collect the console logs for me?

OK, I had a few tabs open. (This forum)

Started the browser console,
Went to the Microsoft webpage for the Media Creation Tool, (I have it bookmarked).
Clicked to download the tool,
Clicked 'save file' in the popup,
Got the 'Download blocked' page,

Copied and pasted the console contents into the textfile attached. (Couldn't see any option to save it?)

Hope it helps.

 

consolelog.txt

[nukecad]

Firefox has now updated to v60 and the Malwarbytes extension to v1.0.21

The downloading block on the MCT installer has gone and it downloads OK now.

Hope the console log is of some use anyway.

Edited May 11, 2018 by nukecad

[rakka]

@nukecad thanks for the logs, let me know if issue comes back, 

[nukecad]

15 hours ago, rakeshsejwal said:

@nukecad thanks for the logs, let me know if issue comes back, 

@rakeshsejwal

I believe that I have now tracked this issue down.

This morning I decided to test the downloads again.

I tried to download both the Media Creation Tool, and MB3.5.
And they were both blocked again!

Something seems to have happened overnight, so some more testing was called for.

Removed the Firefox extension.
Attempted the downloads again without the extension, of course both were sucessful.

Reinstalled the Firefox extension
Attempted the downloads, both were sucessful.

Shut down the computer.
Rebooted and attempted the downloads, both were sucessful.

Scratched my head, what else could I have done between yesterday and this morning?
Well I usually run CCleaner before I shut down for the night, so let's try that.

Ran CCleaner, shut down and rebooted.
Attempted the downloads, both were blocked.

Removed the extension, closed and reopened Firefox, reloaded the extension.
Attempted the downloads, both were sucessful.

I can repeat this at will, run CCleaner to clear Firefox and the downloads are then blocked, remove and reload the extension and downloads are not blocked.
(PS. There is no need to close Firefox before reloading the extension, just click 'remove' and then 'undo' in the add-ons manager).

So it appears that the extension relies on some file that CCleaner v5.42.6495(64-bit) is clearing from Firefox.

I'll try and test it further to track down just what file CCleaner is removing that causes the issue, but this may take a while.

Just to be clear this is the normal cleaning function of CCleaner, I don't/didn't use the registry cleaner function.

 

Edited May 12, 2018 by nukecad

[Swandog46]

Wow, that's very interesting, thank you for that!  We will look into what CCleaner does here.  Stupid CCleaner, deleting others' files at random :/

[nukecad]

26 minutes ago, Swandog46 said:

 Stupid CCleaner, deleting others' files at random :/

Well.....just for a bit more info I took CCleaner back to v5.25.
This is the oldest installer for it that I have saved, and is from December 2016.

Running that still removes the file that the MB extension relies on and thus 'breaks' the downloads.
Which indicates that CC was cleaning that location well before the extension started storing things there.

It's interesting that the 'Remove' & 'Undo' in the Add-ons manager fixes the problem, without the need to close Firefox or fully reinstall the extension.

[Swandog46]

Our guess is that CCleaner deletes all the data files stored by the extension including our databases, and refreshing/reinstalling the extension prompts our extension to re-download them.  Probably waiting until the next update would work too.

[nukecad]

I've tracked it further.

It's the cleaning of Firefox 'Site Preferences' by CCleaner that causes the blocks to start happening.

Everything else cleans without the problem appearing.

On my machine that's the file-

C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\06je2au8.default-1470890772048\permissions.sqlite

Edited May 12, 2018 by nukecad

[John L. Galt]

Great detective work there.  And now I understand why I could never replicate it - I swore off using CCleaner (and any other such app, including, but not limited to, registry cleaners and RAM boosters).  I've found that every one of those apps will do something that at some point will affect you in a negatively at some point down the road, unless you control every step it takes manually - and if you (can) do that, you can perform the same steps without actually using any of those apps to begin with (which is what I have now adopted as my clean mgmt system instead).

Speaking of managing it - is there a setting in CCleaner's settings for Firefox profiles that allows you to skip cleaning permissions.sqlite so that the MB for Fx retains its settings?

@Swandog46 @rakeshsejwal - Going forward, is this going to require some sort of coordination with Piriform to have them whitelist the MB entries when their customers use CCleaner, or IS MB going to simply post a list of 'exclusions' in a post (maybe even here) when using CCleaner alongside the addon for Fx to prevent this from happening in the future?

I know that more than a couple of my customers swear by CCleaner and similar products....