MacKeeper reporting false positive for Firefox 6 extension

I tried twice today to download and install the new extension for Firefox 6 and each time I get an alert from MacKeeper that it installed an infected file (global.min.js) - I tossed it the first time and quarantined it the 2nd time. Is this a known issue? Or is there some other reason that MacKeeper would report it as containing a virus?

Much Thx
Leslie

Comments

  • poof
    poof
    Community Member
    Tools like that can give false positives. In other words, it is possible for tools like these to mark harmless Javascript scripts and things like that as harmful. The new extensions for Firefox 6 and up, and Safari 5.1 and up use Javascript (In Firefox this would be the JetPack API). I don't know if that file belongs to the new extension and is harmless. I downloaded the 3.8b5 xpi and looked at with Zipeg (it is a zip file viewer for OS X; xpi's are just zipfiles). I managed to find the global.min.js file in the folder onepassword-at-agilebits-dot-com-onepassword-lib so it seems to be a valid file. From the comments of the file:

    // A JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined
    // in FIPS PUB 180-1
    // Version 2.1a Copyright Paul Johnston 2000 - 2002.
    // Other contributors: Greg Holt, Andrew Kepert, Ydnar, Lostinet
    // Distributed under the BSD License
    // See http://pajhome.org.uk/crypt/md5 for details.


    I have no idea why MacKeeper would fire off an alert for something like that, it seems completely harmless.
  • I also get a false positive with Avira on the PC. Makes the extension partialy unusable because the path to the file will always change. So even when exempting that file within Avira, the next time Firefox is started, it gives the alert all over again.
  • If anything MacKeeper is a virus.
  • Hello,

    I just upgraded to latest 1Pw for Mac, then upgraded my Firefox and proceeded to install the 1Pw Extension for Firefox 6.
    As soon as I do that I get a warning from Mackeeper Antivirus Program that the file is infected !?

    Has anybody else encountered this ?
    Should I be worried ?

    Below is log entry.
    File moved to quarantine: /Users//Library/Application Support/Firefox/Profiles/ghnqraqd.default/extensions/onepassword@agilebits.com/resources/onepassword-at-agilebits-dot-com-onepassword-lib/global.min.js

    Mackeeper antivirus classifies as "HTML/Crypted.Gen


    Any advice would be welcome

    M
  • poof
    poof
    Community Member
    @above: that is your personal opinion or you're mistaken it for the MacDefender malware.

    @Tobi: Avira is known for its false positives so you might want to rethink your virusscanner.
  • Hi mightydutchman2,

    Welcome to the forums. :)

    This is a false positive from Mackeeper and we have already notified them of the error.

    Thanks
    Ben
  • Thanks Ben, that confirms my suspicions (y)
  • henryct
    henryct
    Community Member
    edited August 2011
    mackeeper has found a trojan in the following file:

    users/me/Library/Application Support/Firefox/Profiles/avdr8z6l.default/extensions/onepassword@agilebits.com/resources/onepassword-at-agilebits-dot-com-onepassword-lib/global.min.js

    unable to upload file via this website
    I've quarantined
    please provide information.

    1password 3.8.1, firefox 6.0
  • Most likely a false positive, get rid of your MacKeeper scareware.
  • This is a false positive on MacKeeper's part. We've already alerted them about this. Thanks for the report, and welcome to the forums. :)
  • khad
    khad
    1Password Alumni
    Thanks for reporting this, Leslie. It is definitely nothing to worry about. I will see if we can actually get ahold of MacKeeper and recommend you do the same. i am wondering if the warning is related to installing any Firefox extension (not a particular one), though you do mention a specific file. I am aware of an issue with ClamXav which has an option to specifically block installation of Firefox extensions. I guess this is somehow safer, but I am personally very satisfied with the protection Firefox itself includes. No extension can install without confirmation.

    Do you have any option like that enabled in MacKeeper? I have never used it, so I don't know if that is even a possibility.

    Please let me know.

    Cheers,
  • Hello M,

    On behalf of Ben, you are very welcome!

    We appreciate your information, and it adds to our legitimacy while discussing with MacKeeper.

    Cheers!

    Brandt
This discussion has been closed.