645574 - Problem with avira when open and close firefox - malware warn

Status: RESOLVED INVALID

(Firefox :: General, defect)

Description

[Puding]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Windows NT 6.1; rv:2.0) Gecko/20100101 Firefox/4.0

I always used firefox and Avira AntiVir together, but today, avira began showing a Malware Warn when i open or close firefox.

Is this a bug?

Check the image: http://cl.ly/5WOf/Screen_shot_2011-03-27_at_8.38.40_PM.png

"HTML/Framer.R.1"

File CACHE_001_ at AppData\Local\Mozilla\Firefox\Profiles\5stal0wv.default\Cache

Reproducible: Always

Steps to Reproduce:
1. Install Avira AntiVir Free
2. Open FireFox and wait for the Malware warn Pop-up
3. Or close the Firefox and wait for the warn.
Actual Results:  
Avira warns me about a file!

Expected Results:  
Nothing.

Comment 1

[Jo Hermans]

Avira has seen some malware in the cache. This is pretty normal and not very dangerous - that's what an antivirus tool does. The cache is exactly where such malware would be stored when you encounter it on some website. You can easily clean the cache to get rid of it (or let Anvira delete it), or wait until it get overwritten by new data.

It's not dangerous, and the malware can not do anything unless you go back to the website where you've encountered it. In which case it wouldn't matter if you cleaned the cache, as it would be downloaded again.

Comment 2

[Puding]

I know, its a false-positive, there is no malware or virus on the cache. But all the times when firefox creat cache, avira warns me about a malware. I think its a bug on firefox.

Comment 3

[Jo Hermans]

The cache contains ONLY data which is retrieved from websites. If there's truly some malware in it, then you have visited such a website.

Unfortunately, since it's in the CACHE_001_ file, which is a single file for all "small" webpages (to avoid to create a new file for each) you can't really see from which website it actually comes. 

If Avira triggers every time, and you're sure that you haven't visited such a site, then it's possible that Avira thinks that the internal file structure itself contains the malware. That's is a false positive, and is not a bug. Avira is the only one that can fix it.