download virus scanning not always working

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

download virus scanning not always working

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Web & Mail Security] >> GFI WebMonitor >> download virus scanning not always working

Page: [1]

Message

<< Older Topic Newer Topic >>

download virus scanning not always working - 14.Jun.2009 10:41:21 PM

tasdevil

Posts: 13
Joined: 14.Jun.2009
Status: offline

Hi.
I'm curious why GFI webmonitor sometimes doesnt virus scan download files.
E.g. http://fedoraproject.org/get-fedora

CLicked download now under "Upgrade to Fedora 11 from an older version" and the explorer download window came straight up without being scanned by the anti-virus. Have seen this a few times havent figured out the patten yet. (I know this is a real big file, but its happened on other files much much smaller). most files are scanned though.

thanks if anyone has any ideas.
Latest version 2009 (evaluation although our order is in the system somewhere)

Post #: 1

RE: download virus scanning not always working - 15.Jun.2009 8:50:04 AM

DrewE

Posts: 1032
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

GFI WebMonitor does keep a cache of files it has scanned lately. Can you try downloading the same file twice? Do you notice it occurring then?

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to tasdevil)

Post #: 2

RE: download virus scanning not always working - 15.Jun.2009 8:17:59 PM

tasdevil

Posts: 13
Joined: 14.Jun.2009
Status: offline

I tried downloading it again, same thing - the normal explorer "downloading" popup window appeared straight away and downloads the file direct (400k/sec). cached things download at about 4meg/sec.

(in reply to DrewE)

Post #: 3

RE: download virus scanning not always working - 16.Jun.2009 5:55:36 AM

DrewE

Posts: 1032
Joined: 28.Apr.2008
From: Cary, NC
Status: offline

Do you find it depends on the type of file you are downloading? The file you mentioned earlier was a .ISO file, can you download a .zip file or .exe file and see the scanner window?

_____________________________

Drew Easley - Technical Support Representative
GFI Software - www.gfi.com

(in reply to tasdevil)

Post #: 4

RE: download virus scanning not always working - 16.Jun.2009 7:25:07 AM

tasdevil

Posts: 13
Joined: 14.Jun.2009
Status: offline

oh thanks! hehehehe

Didnt think of that - i just assumed it scanned everything.... the pressures of end-of-financial year rushes......

Changed the default policy for virus scanning and is all good now the ISO is being scanned. I'll keep that in mind next time i see something being missed check it out.

thanks for your time :)

bye

(in reply to DrewE)

Post #: 5

RE: download virus scanning not always working - 18.Jun.2009 12:12:48 AM

tasdevil

Posts: 13
Joined: 14.Jun.2009
Status: offline

hmmmmm

More problems with files not being scanned.....

I did try putting scan (and display) for all other file types, but then it screwed up going to www.hotmail.com and i couldnt make it work. I found the file content types for .iso and they are now being scanned.

I just downloaded from microsoft an .exe (IE8) and it wasnt scanned. When i go to active connections, it says "Receiving real filetype:executable"

I have noticed a number of files as being real filetype, how does one specify that in content filetype box as this isnt a mime type??? In this case though, I guess GFI might want to add that to the "Executable" definition...

thanks in advance
(I have a screenshot of the console showing this if you want it).

(in reply to tasdevil)

Post #: 6

RE: download virus scanning not always working - 18.Jun.2009 3:26:14 AM

davidf

Posts: 143
Joined: 29.Jul.2003
Status: offline

dont put scan all other types with download status window as it will break retrieving of some important filetypes for some sites.

I checked download url from your first post and it redirects to FTP site
ftp://ftp.surfnet.nl/pub/os/Linux/distr/fedora/linux/releases/11/Live/i686/Fedora-11-i686-Live.iso

Do you have IE configured to use ftp via proxy? If yes, "Enable folder view for ftp sites" should be disabled. If this checkbox is selected IE exibits the same behavior as typical ftp client program.. i.e. its not passing via proxy and therefore downloads are not beeing scanned.

(in reply to tasdevil)

Post #: 7

RE: download virus scanning not always working - 18.Jun.2009 6:28:53 AM

tasdevil

Posts: 13
Joined: 14.Jun.2009
Status: offline

hi david, thanks for getting back to me.

I got the fedora scanned by adding a .iso content-type (which i found from the active connections branch of the gfi monitor).

The one i dont understand now is the .exe file i was talking about.
If you go to microsoft.com, http://www.microsoft.com/windows/internet-explorer/default.aspx to download IE8, click on the big orange "Download Now". The file downloads here without being scanned (all other .exe seem to get scanned).

The active connections branch shows the file coming from http://download.microsoft.com/download/D/C/F/DCF5DACB-313F-40C6-889C-AD1F8546099D/IE8-WindowsVista-x64-ENU.exe (I'm in australia so i dont know if this is a local mirror).

The file type is shown as "real filetype: executable"

any ideas on this one?
(PS I turned off the ftp option you talked about it didnt make any difference)

thank you for your time.

(in reply to davidf)

Post #: 8

RE: download virus scanning not always working - 18.Jun.2009 7:01:08 AM

davidf

Posts: 143
Joined: 29.Jul.2003
Status: offline

*.microsoft.com is in whitelist that is reason whi its not scanned (I recommend to keep it that way to remove possibility to break updates and to decrease scanning load from WM).

(in reply to tasdevil)

Post #: 9

RE: download virus scanning not always working - 18.Jun.2009 7:10:54 AM

tasdevil

Posts: 13
Joined: 14.Jun.2009
Status: offline

arrrrrhhhh! thank you.

we mainly got the package for content filtering i figured the whitelist was only for that!

many thanks for your time.

(in reply to davidf)

Post #: 10