24

Never mind the fact that Firefox is a browser and not a AV tool, but what exactly does it do after a download? Even on systems that have an up-to-date AV this generates a pause of several seconds after download (where I can't open the file from within the DL manager) and I have no idea what FF might be trying there.

I know I can turn it off (using FF only at work anyway) but I'm wondering. I can think of some things here what it might be:

  1. FF itself is a AV scanner and it loads signatures in the background and whatnot. Sounds highly unlikely and shouldn't need tens of seconds for 20 KiB files.
  2. FF tries to talk with the installed AV to munch the file. Sounds unneeded, given that most AV programs feature real-time protection anyway and therefore will have caught a virus already and also because FF does that on systems without AV installed too.
  3. FF uploads the file to some online virus checker. Unlikely and stupid.
  4. FF instructs some online virus checker to download the file and check it. Unlikely and would be a nice target for DoSing that service.
  5. FF generates a hash of the file and sends that somewhere (presumably Google) to check for. They then respond with either "Whoa, that hash is totally a virus" or "Nope, that MD5 doesn't look very virus-y to me".

I'm running out of better ideas. Anyone have a clue?

1
  • 3
    check answer #2 and you may have a winner :)
    – Molly7244
    Nov 22, 2009 at 22:12

1 Answer 1

18

What the Mozilla Guys have to say:

Anti-Virus Software

Firefox integrates elegantly with your antivirus software. When you download a file, your computer’s antivirus program automatically checks it to protect you against viruses and other malware, which could otherwise attack your computer.

So your assumption on number 2 was correct. I noticed it also does this on computers without an anti-virus like you mentioned, I think this is because it is searching for an installed anti-virus each time.

If you wan't to disable it, in about:config modify browser.download.manager.scanWhenDone and set it to false.

4
  • 1
    Ouch. A little more intelligent behaviour would have been nice, I think.
    – Joey
    Nov 22, 2009 at 22:08
  • Agreed. Any anti-virus I've ever used has had real time protection anyways so I always disable it.
    – user1931
    Nov 22, 2009 at 22:09
  • 4
    Real-time protection doesn't usually do the full scan a download-time scan does, otherwise the performance drag would be even worse than real-time protection already is.
    – bobince
    Nov 22, 2009 at 22:36
  • 1
    bobince: It should at least do a scan once you try executing the downloaded program. If it doesn't, well, then a real-time scanner won't do much good anyway, I think.
    – Joey
    Nov 22, 2009 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .