Quarantine and approve handling

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

Quarantine and approve handling

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Web & Mail Security] >> GFI WebMonitor >> Quarantine and approve handling

Page: [1]

Message

<< Older Topic Newer Topic >>

Quarantine and approve handling - 20.Aug.2009 5:41:19 AM

Bernd Nowak

Posts: 3
Joined: 2.Mar.2005
From: Germany
Status: offline

I have installed the latest version 20090709 but the quarantine and approve handling is strange to me somehow.

We limit the users and most downloads will end in the quarantine.
Now I can approve a download. But the user gets no notification that I have approved the item and I don't see that the item has been scanned for viruses.

Another strange thing to me is that it looks like the approved item is whitelisted and that's the reason why it's not scanned ? A strange thing because tomorrow the same file can be dangerous.

But maybe I'm wrong here ?

Post #: 1

RE: Quarantine and approve handling - 20.Aug.2009 9:02:34 AM

DrewE

Posts: 1058
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

When an item is approved from the GFI WebMonitor quarantine it is added to the temporary whitelist. To download this file the user needs to go back to the website they originally downloaded the file from and try again. It will NOT be scanned by GFI WebMonitor this time.

In the event that the file has changed - and a virus was added to the file the user is downloading - GFI WebMonitor may not detect this. It would be important to review the quarantine and see why the file was blocked originally. Also having an up-to-date AntiVirus scanner on each desktop would be ideal.

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to Bernd Nowak)

Post #: 2

RE: Quarantine and approve handling - 27.Aug.2009 5:56:05 AM

Bernd Nowak

Posts: 3
Joined: 2.Mar.2005
From: Germany
Status: offline

Drew,
thanks for the answer but if you have a blocking rule that will block all exe files and quarantain them (or better the link to the exe file) then the file hasn't scanned.

If I now approve this file and add it to the temporary whitelist it will bypass the registered anti-virus products from GFI webmonitor.

You said that the desktop should have an antivirus product. Sure but the reason why we have choosen GFI webmonitor is that we have 2 or 3 additional scan engines so our users and our network is at least protected a bit more.

I have submitted a feature request to allow scanning of quarantined items before approving them. This will not help if the file has changed. But for my liking it should be possible to scan files which are blocked due to a blocking rule.

(in reply to DrewE)

Post #: 3