582360 - McAfee Total Protection blocks Firefox 3.6.8 after update

Status: RESOLVED WORKSFORME

(Release Engineering :: General, defect)

Description

[Matthew Middleton (:zzxc)]

Numerous users have reported that fully updated McAfee Total Protection is blocking all connections after Firefox 3.6.7 updates to Firefox 3.6.8.  In most cases, setting the firewall rule for Firefox from "Block" to "Allow" fixes the issue, but some users have had to use the reset feature in McAfee Security Center to restore default settings.

Users have reported this behavior on Windows XP, Windows Vista, and Windows 7 computers.  Most users were asked to check for McAfee updates and have confirmed that McAfee is fully updated.

Comment 1

[Matthew Middleton (:zzxc)]

I tested this myself with McAfee Total Protection, and I do not see the problem when upgrading from 3.6.6 to 3.6.7 on Windows 7.  My test was with this build information:

McAfee Personal Firewall 11.5.131 (7/27/2010)
McAfee VirusScan 14.5.113 (7/27/2010)
McAfee SecurityCenter 10.5.194 (7/27/2010)

Users have reported that the problem doesn't go away after updating, so it seems likely that only users who updated Firefox before McAfee updated are currently affected.

Comment 2

[Matthew Middleton (:zzxc)]

I've confirmed with affected users that the problem continues even after updating McAfee to the version numbers I listed above.

As of the latest update, resetting firewall settings fixes the problem:
1. Open McAfee Security Center
2. Click Firewall
3. Click Settings
4. Press "Restore defaults"

Comment 3

[Matthew Middleton (:zzxc)]

(In reply to comment #1)
> upgrading from 3.6.6 to 3.6.7 on Windows 7

Sorry, what I actually tested was upgrading 3.6.7 to 3.6.8, using Help->Check for updates.

Comment 4

[Matthew Middleton (:zzxc)]

->WFM, since current McAfee is no longer blocking users who upgrade.

Users with Firefox already blocked in McAfee still have to perform the steps in comment 2, which we are documenting on support.mozilla.com.

Comment 5

[famellee]

I am an engineer at McAfee and we were notified about this issue. It would be appreciated if someone who had this issue can attach logs file to this bug by following steps below:

- Download and run McTrace.exe from http://beta.mcafee.com/betamcafee/McTrace.aspx on the machine where this issue happened. 
- Select the option "Collect logs only" and click on Start button.
- McTrace would create a zip file (by default named MCLOGS.zip) and please attach it to this bug.

We try to understand what happened at that time since we couldn't reproduce the problem at this time. Thanks in advance for the help.

Comment 6

[Matthew Middleton (:zzxc)]

Attachment: McAfee logs from a user, as requested in comment 5

This is the output generated by an affected user following the instructions in comment 5.

Comment 7

[famellee]

Thanks for the log files. It looks like before the signature of Firefox 3.0.8 was updated in McAfee’s HackerWatch online database, McAfee Total Protection did prompt user about FF 3.0.8 multiple times from 07/27 to 07/29, and when the alert was displayed the last time at 07/29, the action “BLOCK” was taken from the alert, and that’s the last time we were asking for Firewall permission for FF 3.0.8. Is there any chance user clicked on “BLOCK” from alert by mistake? It is the right most button on the alert.
We couldn’t reproduce the issue now because McAfee HackerWatch team already added FF 3.0.8 to our whitelist and it will be allowed by McAfee Firewall automatically.