download virus scanning not always working (Full Version)

All Forums >> [Web & Mail Security] >> GFI WebMonitor



Message

tasdevil -> download virus scanning not always working (14.Jun.2009 10:41:21 PM)

Hi.
I'm curious why GFI webmonitor sometimes doesnt virus scan download files.
E.g. http://fedoraproject.org/get-fedora

CLicked download now under "Upgrade to Fedora 11 from an older version" and the explorer download window came straight up without being scanned by the anti-virus. Have seen this a few times havent figured out the patten yet. (I know this is a real big file, but its happened on other files much much smaller). most files are scanned though.

thanks if anyone has any ideas.
Latest version 2009 (evaluation although our order is in the system somewhere)




DrewE -> RE: download virus scanning not always working (15.Jun.2009 8:50:04 AM)

GFI WebMonitor does keep a cache of files it has scanned lately. Can you try downloading the same file twice? Do you notice it occurring then?



tasdevil -> RE: download virus scanning not always working (15.Jun.2009 8:17:59 PM)

I tried downloading it again, same thing - the normal explorer "downloading" popup window appeared straight away and downloads the file direct (400k/sec). cached things download at about 4meg/sec.



DrewE -> RE: download virus scanning not always working (16.Jun.2009 5:55:36 AM)

Do you find it depends on the type of file you are downloading? The file you mentioned earlier was a .ISO file, can you download a .zip file or .exe file and see the scanner window?



tasdevil -> RE: download virus scanning not always working (16.Jun.2009 7:25:07 AM)

oh thanks! hehehehe

Didnt think of that - i just assumed it scanned everything.... the pressures of end-of-financial year rushes......

Changed the default policy for virus scanning and is all good now the ISO is being scanned. I'll keep that in mind next time i see something being missed check it out.

thanks for your time :)

bye
[:)]



tasdevil -> RE: download virus scanning not always working (18.Jun.2009 12:12:48 AM)

[&:]  hmmmmm

More problems with files not being scanned.....

I did try putting scan (and display) for all other file types, but then it screwed up going to www.hotmail.com and i couldnt make it work. I found the file content types for .iso and they are now being scanned.

I just downloaded from microsoft an .exe (IE8) and it wasnt scanned. When i go to active connections, it says "Receiving real filetype:executable"  


I have noticed a number of files as being real filetype, how does one specify that in content filetype box as this isnt a mime type??? In this case though, I guess GFI might want to add that to the "Executable" definition...

thanks in advance
(I have a screenshot of the console showing this if you want it).



davidf -> RE: download virus scanning not always working (18.Jun.2009 3:26:14 AM)

dont put scan all other types with download status window as it will break retrieving of some important filetypes for some sites.


I checked download url from your first post and it redirects to FTP site
ftp://ftp.surfnet.nl/pub/os/Linux/distr/fedora/linux/releases/11/Live/i686/Fedora-11-i686-Live.iso


Do you have IE configured to use ftp via proxy?  If yes, "Enable folder view for ftp sites" should be disabled.  If this checkbox is selected IE  exibits the same behavior as typical ftp client program.. i.e. its not passing via proxy and therefore downloads are not beeing scanned.



tasdevil -> RE: download virus scanning not always working (18.Jun.2009 6:28:53 AM)

hi david, thanks for getting back to me.

I got the fedora scanned by adding a .iso content-type (which i found from the active connections branch of the gfi monitor).

The one i dont understand now is the .exe file i was talking about.
If you go to microsoft.com, http://www.microsoft.com/windows/internet-explorer/default.aspx to download IE8, click on the big orange "Download Now". The file downloads here without being scanned (all other .exe seem to get scanned).

The active connections branch shows the file coming from http://download.microsoft.com/download/D/C/F/DCF5DACB-313F-40C6-889C-AD1F8546099D/IE8-WindowsVista-x64-ENU.exe (I'm in australia so i dont know if this is a local mirror).

The file type is shown as "real filetype: executable"

any ideas on this one?
(PS I turned off the ftp option you talked about it didnt make any difference)

thank you for your time.



davidf -> RE: download virus scanning not always working (18.Jun.2009 7:01:08 AM)

*.microsoft.com is in whitelist that is reason whi its not scanned (I recommend to keep it that way to remove possibility to break updates and to decrease scanning load from WM).





tasdevil -> RE: download virus scanning not always working (18.Jun.2009 7:10:54 AM)

arrrrrhhhh! thank you.

we mainly got the package for content filtering i figured the whitelist was only for that!

many thanks for your time.



Page: [1]