How to disable "URL Blocker" of Browsing Protection? I am worring rating of false positives by F-sec

yagisan_post

Hello, thanks for your reading here. I want to ask you about method to disable URL filtering feature of Browsing Protection by F-secure SAFE.

 

I was using F-secure SAFE until 2 weeks ago, and it sounds good as a home security solution.

But I realized about too many false positive ratings by "URL blocker" feature of "Browsing Protection" by F-secure SAFE.

 

Even I was using browser for accessing normal web sites, it was many blocking logs as "Dangerous URL" by Borwsing Protection.

 

Many web sites which were blocked by F-secure are judged as safe website by other security software (e.g. Avast Free, Avira...) , so I tried access again after unchecking the box of "Block suspicious web sites", but there are many logs of blocking URLs at event viewer of F-secure.

 

I was not able to stop URL blocker completely.

I don't want to enable URL Blocking feature if there are many false positive ratings.

 

I want to know about how to turn off URL blocker by Browsing Protection.

I want to use "Browsing Protection" feature without URL filters by F-secure. I want to only malware blocking feature by Browsing Protection( Of cause, I was introduced F-secure's Extension to my Browsers).

 

Please tell me about above question.

Thank you very much.

 

~~~~~~

F-secure SAFE Latest Edition (and Updated completely)

Windows10 Home, Google Chrome, Mozilla Firefox

Simon

I've been using Browsing Protection for years and could probably count the number of sites it's blocked on one hand.  Unless you have a habit of visiting dubious websites, I'm wondering if perhaps something else may be going on, and maybe your browser has been hijacked or otherwise compromised?  Have you done a full virus scan recently?  I would also recommend a scan with www.Malwarebytes.org, as that may find stuff like Adware and PUPs which F-Secure may not pick up.  

Ukko

Hello,

 

Sorry for my reply.

 

// Just as additional to previous reply with maybe reasonable ask too. //

 

--> ""I want to only malware blocking feature by Browsing Protection""

 

What do you mean? How I can to understand Browsing Protection work with next meanings:

 

If URL (it can be direct URL for the malicious files) marked as "harmful" (under F-Secure Security Cloud) it will be blocked as harmful-rated page (not a malware in fact, but access to this URL).

 

If URL marked as "suspicious" (under F-Secure Security cloud) it will be blocked as suspicious-rated page (if this option checked);

 

How I can to understand - you have experience with "disable/uncheck" option about "blocking suspicious rated pages".

If you want do not block harmful-rated pages - you have to turn off Browsing Protection feature.

This one: https://help.f-secure.com/product.html#home/safe-windows/2016/en/task_D4AA989E68A94120BBA9C9299924D4FA-safe-windows-2016-en

 

Right-top side of this tab and switch from "On" to "Off".

Probably as result will be also disabled "rating pictures under the search results with Google/Bing/Yahoo".

 

====================

 

But  I can to think that can be helpful next steps (than just disable blocking harmful/suspicious rated pages):

 

--> With each page - you able to allow this website. Maybe this is not friendly, but enough  - if you sure that pages are safe and you want to use page.

 

--> If you sure that this is f/p - can be helpful transfer URL to the F-Secure SAS:

https://www.f-secure.com/en/web/labs_global/submit-a-sample#sample-url

(it possible transfer text-file with many URLs)

 

For re-rate from harmful-rating to safe-rating.

 

This step will be helpful for all F-Secure users.

 

===========================

 

I not really often met harmful/suspicious-rated pages about certainly safe-pages.

But I have experience about harmful-rating for .js-files, .scripts, .fonts, widgets and other resources.

 

Which marked as malicious. And usually this is tracking, advertisements and related scripts/things (time to time from "not popular" sources).

Usually this resources do not trigger block access to the website, but notification list have a lot of notifications about block-action.

 

==========================

And also I have experience about wrong-category Content blocker feature.

My steps about this - allow website or transfer to F-Secure SAS.

But this is usually not listed under the notification-event-list. So your experience certainly about harmful pages.

yagisan_post

@Simon @Ukko

Hello all. Thank you very much for your quick replies. I read all messages from you.

First, I'm sorry about shortage of my question. It was not enough for answer.

 

I was using F-secure SAFE on my PC (Windows10 Home).

 

I had trouble about false rating "Browsing Protection".
Why I can decide the cause of these ratings as"false ratings",
because of many logs, which were logged when I access only famous websites.

And, other anti-malware solutions are not detecting any threats at these sites.

 

For example, When I was accessing to Nikkei's Official News-site (URL: www.nikkei.com ), which is I often access, event viewer was logging some logs of blocking URL.

That URL's domain was related to nikkei company.

 

I had also another case. In last year, when I searched about smartphones on Google, and I find a page of the IT company.
That company is one of the very famous IT-communication company in Japan, but blocking notification page was showing on browser. Then I send a request to F-secure as false positive.

 

As saying by @Simon, I guessed that my PC was infected some malwares at first. But any malwares were not detected.
And as saying by @Ukko, then I thought that I send requests to F-secure Labs if I will be shown "Blocked by F-secure" at safe website which the safety is sure. But it is very tired working for a user.

 

Now, above false positive ratings are resolved.

But, first of all, I am worrying if important connections are failed by bloking of false positive ratings.

So I want to turn off F-secure's URL blocking system.

If F-secure's URL blocker is using only URL-lists as judgement data, my question will be resolve easily.

But I can not get turn off URL blocker completely. So I posted this question here.

Or it was just only I forgot turn off unchecked some check-box of URL-blocker...?

 

My English is not good, I am thinking it. If you want to know more infomation, pelase tell me.

Thank you very much.

yagisan_post

Additional message:
I want to disable only "URL blocker" by f-secure's browsing protection.
I think that I will continue to using Browser Protection, if I can disable only URL blocker.
Thank you.

Ukko

Hello,

 

Sorry if my reply will be about something else, which you want.

 

I will try to explain "setting" about which I talk:

 

--> For example, we have experience with website, which able to use various .js-files or various resources (pictures, fonts, specific subpages or other).

 

Website can be with safe-rating by F-Secure and we able to use webpage. But some resources can be blocked, because harmful-rated by F-Secure.

Usually this actions should be visible under the notification list.

 

If website marked as harmful-page from first -> we able to allow it (for us) or also transfer URL to F-Secure SAS for re-check rating (for all) under the F-Secure block-page. When we allow certain URL (mainly domain in fact) it will be work for other website's pages too.

 

So if under the notification list a lot of strings about blocking harmful-pages, which about one "valid" domain and you able to target this lines (re-check  - which certain URL there. resources or maybe there is indeed exploiting for website by something) and there looks like all OK. You able to add as exception (to the List of allow/deny websites) this website. As result - connections to this domain should be allowed.

 

 

--> But if there is a lot of websites with such design. And this is not a malicious result.

Or if there potentially can be blocking for important connections (this is can be; at least - if randomly some of "pages/URLs" will be marked as harmful - it can be blocked; there was a lot of examples - usually about updaters with some of software and resources for some of websites.

 

Maybe required other workarounds. But I not sure that possible just "disable" blocking harmful URLs with common meanings. Browsing Protection as module have some of features:

-> Blocking harmful pages (and related things) with additional options to block suspicious pages and not legal pages; Also with ability "show rating pictures under the three search engines";

 

-> Banking Protection;

 

-> Content Blocker (blocking/restrict access to websites for some categories);

 

-> Parental Control features as Device/Web Time usage;

 

If you want to disable "blocking harmful-rated pages":

 

---> You have to disable "Browsing Protection" feature;

 

Like Main UI -> Browsing Protection -> Browsing Protection tab switch from ON to OFF;

As result will be disabled "blocking suspicious rated pages" (if checked) and "blocking not legal pages" (if checked) and "show rating pictures under search engines" (if checked).

 

With this step - most likely - F-Secure will be ignore access to the harmful-rated resources, websites, pages and connections. Not sure that this is valid workaround (at least - allow on-the-fly just certain webpages more nice; and there is should be not often situations, when "critical good safe connection" will be blocked - because randomly marked as harmful. at least it also should be with brief fix).

 

Features like Banking Protection and Parental controls most likely will be still work.

 

Spoiler

If you mean URL blocker not just as "harmful pages block" - but certain restrict for categories (like Gambling, Blogs, Forums...) as Content Blocker feature. So - you just able to turn off "content blocker" tab (under the Browsing Protection module settings).

Sorry for my long reply.

 

 

Maybe there is quite good will be to get proper response from F-Secure Team directly.

 

Thanks.

yagisan_post

Thank you very much for your opinion, and I'm sorry for my too late reply.

After reading your opinion, I sent a message about this problem to F-Secure Support.

 

I have just posted a thread about this problem including a update of solve method which was sent from F-secure Support.

If you take a time to solve this problem, I would like you to visit this thread.

 

Thank you very much.