Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Never mind the fact that Firefox is a browser and not a AV tool, but what exactly does it do after a download? Even on systems that have an up-to-date AV this generates a pause of several seconds after download (where I can't open the file from within the DL manager) and I have no idea what FF might be trying there.

I know I can turn it off (using FF only at work anyway) but I'm wondering. I can think of some things here what it might be:

  1. FF itself is a AV scanner and it loads signatures in the background and whatnot. Sounds highly unlikely and shouldn't need tens of seconds for 20 KiB files.
  2. FF tries to talk with the installed AV to munch the file. Sounds unneeded, given that most AV programs feature real-time protection anyway and therefore will have caught a virus already and also because FF does that on systems without AV installed too.
  3. FF uploads the file to some online virus checker. Unlikely and stupid.
  4. FF instructs some online virus checker to download the file and check it. Unlikely and would be a nice target for DoSing that service.
  5. FF generates a hash of the file and sends that somewhere (presumably Google) to check for. They then respond with either "Whoa, that hash is totally a virus" or "Nope, that MD5 doesn't look very virus-y to me".

I'm running out of better ideas. Anyone have a clue?

share|improve this question
check answer #2 and you may have a winner :) – Molly7244 Nov 22 '09 at 22:12
up vote 18 down vote accepted

What the Mozilla Guys have to say:

Anti-Virus Software

Firefox integrates elegantly with your antivirus software. When you download a file, your computer’s antivirus program automatically checks it to protect you against viruses and other malware, which could otherwise attack your computer.

So your assumption on number 2 was correct. I noticed it also does this on computers without an anti-virus like you mentioned, I think this is because it is searching for an installed anti-virus each time.

If you wan't to disable it, in about:config modify and set it to false.

share|improve this answer
Ouch. A little more intelligent behaviour would have been nice, I think. – Joey Nov 22 '09 at 22:08
Agreed. Any anti-virus I've ever used has had real time protection anyways so I always disable it. – John T Nov 22 '09 at 22:09
Thanks a lot. Regards. – Xavierjazz Nov 22 '09 at 22:18
Real-time protection doesn't usually do the full scan a download-time scan does, otherwise the performance drag would be even worse than real-time protection already is. – bobince Nov 22 '09 at 22:36
bobince: It should at least do a scan once you try executing the downloaded program. If it doesn't, well, then a real-time scanner won't do much good anyway, I think. – Joey Nov 22 '09 at 22:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.