I understand you use a Google resource to determine that certain sites may be a source of suspect files. The problem with this is that public fileshare sites are often included, with many completely legitimate files blocked as a result. What I absolutely do NOT understand is why you have configured Firefox so that the file (100s of megabites in many cases) completes downloading before indicating that it has been blocked. This makes absolutely NO sense, and wastes huge amounts of bandwith. Since the source is known before the file is downloaded, the download should be blocked before it is begun. Please fix this !!!!!

I also recommend that in such cases, you should produce a message indicating that the download is from a suspected site, and give the user the option to continue anyway. This is certainly preferable from a security standpoint to having the user turn off all site-based security and then have to remember a long time later after downloads complete to turn it back on.