MB4 Offline Setup Suspicious Download

[1PW]

https://downloads.malwarebytes.com/file/mb4_offline   >   redirects to   >

https://data-cdn.mbamupdates.com/web/mb4-setup-consumer/offline/mb4-setup-consumer-4.1.0.145-1.0.867-1.0.21792.exe

https://www.virustotal.com/gui/file/8dc24048cc087ca48eda82681b6c0d040918a2957c781eefee8db3bb749a5653/detection

Firefox 74.0.1 / MBG 2.2.1

Edited April 4, 2020 by 1PW

[Porthos]

I see nothing blocking or unusual.

[AdvancedSetup]

The VT link shows 0 infections.

Since you posted in the Malwarebytes Browser Guard section of the forums for Firefox I assume you're  using Firefox @1PW and that you're saying MBG blocked the full offline installer download?   I was not able to replicate this block.

Can you please provide more details or screenshots of what you're experiencing.

Thank you

 

 

[1PW]

@AdvancedSetup:

PM sent.

[1PW]

Hello Ron:

I removed and reinstalled MBG 2.2.1   I followed by reinstalling Firefox 74.0.1 & MBG.

The MB4 offline suspicious download FP is predictable and repeatable.

HTH

 

 

[Porthos]

When I open the link in your first post I see the following and have no issue downloading MB.

Edited April 4, 2020 by Porthos

[Hardhead]

Hmm 🤔 

I can get the update at both sites. 

[AdvancedSetup]

I believe that @1PW may have an outdated MBG add-on

I've asked him to remove and reinstall it

 

[1PW]

Observation:

If the generic address is used used for the URL, https://downloads.malwarebytes.com/file/mb4_offline the suspicious download warning appears within 1 second.

However, if the redirect address is used, the download will start/finish unimpeded.

HTH

 

[Porthos]

19 minutes ago, 1PW said:

Observation:

If the generic address is used used for the URL, https://downloads.malwarebytes.com/file/mb4_offline the suspicious download warning appears within 1 second.

However, if the redirect address is used, the download will start/finish unimpeded.

HTH

 

I clicked the above link in your post and no issues or warnings.

[1PW]

4 minutes ago, AdvancedSetup said:

I believe that @1PW may have an outdated MBG add-on

I've asked him to remove and reinstall it

This was not to be the case the case.  Prior to this topic, I had updated to FF 74.0.1.  Additionally, MBG 2.2.1 had been in use NLT 25-March-2020 because I truly follow MBG so closely.

As I have related, the FF 74.0.1 application has now been downloaded, SHA2 verified, and installed.  MBG 2.2.1 has been removed and reinstalled multiple times today.

Using the generic MB4 offline download, the MBG 2.2.1 suspicious download warning is now both predictable as well as repeatable.

The only unexplored variable is possibly the MacOS 10.15.4 (19E266) Catalina OS on a MacBookPro11,3 in use.  However, the downloaded extension is still the same.

HTH

 

[Porthos]

2 minutes ago, 1PW said:

The only unexplored variable is possibly the MacOS 10.15.4 (19E266) Catalina OS on a MacBookPro11,3 in use. 

That has to be it. The rest of us are using Windows.

Would have helped if you mentioned that in the first post.

Edited April 4, 2020 by Porthos

[1PW]

1 hour ago, Porthos said:

That has to be it.

Hello @Porthos:

Without definitive proof, I am not quite ready to connect those dots just yet.  Since early beta testing, I have not remembered experiencing MacOS unique issues with MBG.

Perhaps a need exists for the QA folk to test MBG 2.2.1 in separate Linux and MacOS environments.  For the moment, this seems to be a staff/dev question.

What I do not want to forget is that the MBG extension is the same for all user platforms.

Cheers

[AdvancedSetup]

@gonzo

Can you please review for additional white listing as needed

 

[1PW]

MBG Suspicious download of MB4 offline resolved with FF 75.0 / MBG 2.2.2

Thank you all.

[gonzo]

Worked fine with FF74.0.1/BG2.2.1 and Chrome with same BG version

[1PW]

Hello Mike:

True. The previous versions of Chrome and MBG gave no trouble.  Only the previous versions of Firefox and MBG on a MacBook Pro were troublesome.

Thank you.

 

[1PW]

The above situation seems to have returned with current MacBook Pro versions:

https://downloads.malwarebytes.com/file/mb4_offline

redirects to 

https://data-cdn.mbamupdates.com/web/mb4-setup-consumer/offline/mb4-setup-consumer-4.1.0.149-1.0.875-1.0.22506.exe

 

[AdvancedSetup]

Perhaps some way MBG is interacting with your Mac @1PW  ??

I just downloaded it on Windows 10 Pro x64 with Firefox 75. 0 and MBG 2.2.2 and had no issue

 

[1PW]

On 4/28/2020 at 11:20 PM, AdvancedSetup said:

Perhaps some way MBG is interacting with your Mac @1PW  ??

Hello Ron:

Yes.  I believe that probability is high.  MBG 2.2.2 seemed to resolve a similar issue earlier earlier this month.  I hope a MBG team member can parcel out some time to check again with their Mac.

Cheers.

[gonzo]

No problems noted here on Windows with either major browser

[AdvancedSetup]

59 minutes ago, gonzo said:

No problems noted here on Windows with either major browser

@gonzo the user is on a Mac

 

[1PW]

The above issue seems to have sustained using Apple's macOS 10.15.4 Catalina, Firefox 76.0 (64-bit) for Mac, and today's MBG 2.2.3 extension update.

https://downloads.malwarebytes.com/file/mb4_offline

Edited May 7, 2020 by 1PW

[gonzo]

I am referring this one to the wizards, as it is likely a Mac-related one off that would need to be dealt with separately.  They will not see this until Friday day shift (Pacific time).

[1PW]

@gonzo

Much appreciated.  Thanks Mike!