Download Free Games Blog

UPDATE: September 9, 2009 - Google Safe Browsing technology in Firefox and Google Chrome browsers is no longer blocking Trymedia downloads.  The initial warning page looks to have been a "false positive", meaning the Trymedia downloads were being incorrectly associated with harmful software.  The problem has been rectified by Google and the warning page no longer comes up before downloading.

<begin original post>

Firefox version 3 users are experiencing a warning message when trying to download some of our Trymedia (owned by Real Networks) games.

What is Going On?

Today we discovered that Firefox 3, using technology provided in partnership with Google, is flagging our Trymedia downloads as malicious software.

If you clicked on one of our Trymedia hosted downloads (like John Deere Drive Green), you would get a page with a warning message that looks like the image provided on this page with the following message:

"This web site at d.trymedia.com has been reported as an attack site and has been blocked based on your security preferences.

Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners."

So has DFG been hacked?

No.  And neither has Trymedia. 

What is happening is that Google's technology (used by Firefox) has flagged Trymedia downloads as being unsafe.  The problem here is not malicious software, says Trymedia, it is old software that is possibly causing technology problems.

Clicking the "Why was this site blocked?" button on the warning page would take you to a page containing the following explanation:

"What is the current listing status for d.trymedia.com?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 353 pages we tested on the site over the past 90 days, 6 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-09-04, and the last time suspicious content was found on this site was on 2009-09-04.

Malicious software includes 965 adware(s), 7 trojan(s). Successful infection resulted in an average of 1 new process(es) on the target machine.

Malicious software is hosted on 1 domain(s), including 38.108.189.0/.

This site was hosted on 1 network(s) including AS174 (COGENT).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, d.trymedia.com appeared to function as an intermediary for the infection of 33 site(s) including arcadegamecentral.com/, portalit.net/, dirigoogle.com/.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

How did this happen?

In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.

 

What does this mean?

So basically Google is saying that Trymedia links on certain sites (not ours) were followed and what they determined as suspicious software was installed on a user's machine.  On some sites, Trymedia delivers ads in their download manager to make up for bandwidth costs for providing free game demos and shareware.  That might be what Google is seeing.  It is also possible that the technology that is powering the download manager is doing something strange that Google thinks is malicious.  Sometimes software can perform innocent actions that are misinterpreted as malicious.  When this happens, it is called a "false positive".

So what is DFG doing about this?

Whatever is going on between Google and the Trymedia download manager is unfortunately out of our hands.  However, we have and are doing several things on our end to help resolve this issue:

1) DFG does not allow Trymedia to use advertisements in the download manager of any of the games they provide for our site.

2) I have repeatedly asked Trymedia not to use the download manager at all due to the technical concerns of the program.  We had some problems in the past with a few of our users not being able to delete the download manager from their computer (which is totally unacceptable).  I worked with Trymedia and we posted a fix for this problem. 

So why use the download manager at all? I have been told that some game publishers require the use of the download manager since it helps a download complete at a much better rate than not using it.  So basically DFG doesn't have a choice in the matter but I keep making noise about it anyway since I HATE hearing about any problems our users might be having with downloads from this site.

3) I contacted Trymedia today and insisted that the problem be resolved immediately since it unfairly tarnishes the reputation of our site.  I have been assured they are working around the clock on the problem and will have a response by next week.  It is unclear whether it is a Google Safe Browsing error or a technology error on Trymedia's side.

So should you be concerned about our downloads?

No.  From everything I am told there is no malicious software in the Trymedia download manager.  Somehow the technology the download manager uses is causing a false positive. Also we don't let them run ads so it is neither malware nor adware. 

It is EXTREMELY important to me personally that our site offers only safe downloads to our users.  It is frustrating when issues like this come up and I am doing everything I can on our end to resolve the situation.

We will update our users as soon as we have more info!

Please note that Internet Explorer users have no issues with this warning message and none of Internet Explorer's security functions flag our site or downloads.

Sincerely,

Jim Rosenquist
President