Virus Blockers
From UntangleWiki
About Virus Blocker
Virus Blocker is based on an open-source virus scanner, Clam AntiVirus. Virus Blocker is well-known for its speed and accuracy. If fact, according to an independent evaluation, Virus Blocker (Clam AntiVirus) "beats the pants off its commercial competition".
Virus Blocker does the following:
- Detects viruses, worms, and trojan horses.
- Scans within archives and compressed files: Zip, RAR, Tar, Gzip, Bzip2, MS OLE2, MS Cabinet Files, MS CHM, and MS SZDD.
- Protects against an archive bomb, a file that is repeatedly compressed. Such a file causes virus scanners or other programs to crash or hang by consuming all CPU resources. Intensive resource consumption occurs when the virus scanner scans numerous levels of files within files.
About Kaspersky Virus Blocker
Kaspersky Virus Blocker protects your network against viruses. Kaspersky Virus Blocker took top honors at Untangle’s AV Fight club (virus.untangle.com) last August and has been recognized by leading industry publications.
As you know, viruses arrive over the network using several techniques, so Kaspersky Virus Blocker scans many protocols for the presence of viruses in traffic:
- Email: SMTP, POP, IMAP
- Web: HTTP
- File Transfer: FTP
Why Two Virus Blockers?
Virus Blocker and Kaspersky Virus Blocker complement each other. These two particular solutions together are better than either one alone because they have different engines and virus signature formulations. Most traditional virus blockers use similar engine technology, and so they tend to be redundant rather than complimentary. Different engines can catch viruses that each other might miss. As an analogy, if you have two police departments that employ different techniques to look for criminals, the odds of catching more criminals increases.
Changing Virus Scanning of Web Traffic
To change virus scanning of web traffic:
- From Virus Blocker or Dual Virus Blocker, click the Show Settings tab.
- Specify the HTTP settings:
- Click the HTTP tab.
- In the table, select the scan check box.
- Specify the file types that you want to scan:
- Click the File Extension List tab.
- Select the scan check box for each file type that you want to scan.
- Specify the MIME types that you want to scan:
- Click the MIME Type List tab.
- Select the scan check box for each MIME type that you want to scan.
- Click the Save Settings button.
By default .htm, .html, .js (javascript) and .css (cascading style sheets) are not included in the default File Extension list for scanning. You must add them to the File Extension List if you wish to have them scanned as well.
- Click the File Extension List tab.
- Select the + Add button to add htm
- Select the + Add button to add html
- Continue adding any additional web extensions you wish to have scanned
- Click the Save Settings button.
Changing Virus Scanning of Email
To change virus scanning of email:
- From Virus Blocker or Dual Virus Blocker, click the Show Settings tab.
- Click the Email tab, and click the SMTP, POP, or IMAP tab that corresponds to the type of email that your company uses.
- In the table, select the row that corresponds to the FTP traffic that you want to scan.
- Select the scan check box, and click the Save Settings button.
- remove infection. Removes the virus without changing any user data.
- pass message. Sends email without removing the virus.
- block message. Blocks the email without removing the virus.
scan When the check box is selected, the Untangle Server scans email for viruses in both directions unless there is a custom policy that overrides these instructions. action if Virus detected
Changing Virus Scanning of File Transfers
To change virus scanning of file transfers:
- From Virus Blocker or Dual Virus Blocker, click the Show Settings tab.
- Click the FTP tab.
- Select the scan check box, and click the Save Settings button.
Changing Virus Scanning of File Downloads
If you change any virus scanning settings, the Untangle Server resets (terminates) existing connections. Email clients experience a brief disruption, and display a message to email users. Within a few seconds, the email clients reconnect.
To change virus scanning of file downloads:
- From Virus Blocker or Dual Virus Blocker, click the Show Settings tab.
- Click the General Settings tab.
- Specify the values for the following settings:
- Click the Save Settings button.
disable FTP download resume The FTP protocol has an advanced feature that allows an interrupted file download to be resumed (restarted) where the download ended. Although a handy feature for unreliable networks, the Untangle Server cannot scan a file transfer for viruses when this feature is enabled. When FTP download resume is permitted, a file containing a virus could be transmitted over multiple connections and the Untangle Server will only see parts of the file and be unable to perform a complete scan. disable HTTP download resume The HTTP protocol has an advanced feature where an interrupted file download may be resumed (restarted) where it left off. Although a handy feature for unreliable networks, the Untangle Server is unable to perform virus scans when this feature is enabled. When HTTP download resume is permitted, it is possible that a file containing a virus could be received over multiple connections. When this occurs, the Untangle Server only sees parts of the file at once and cannot know if it contained a virus. scan trickle rate (percent) This is an advanced feature, controlling how quickly files are downloaded relative to scanning. Caution: As an advanced feature, you should not change this value unless instructed to by a member of Untangle Technical Support or one of their authorized representatives.
About Virus Blocker and Kaspersky Virus Blocker Event Log
Use the following terms and definitions to understand the Virus Blocker Event Log:
timestamp The time the event took place. action The action taken on the document (HTTP response, FTP file, or email). The value depends on the mail protocol, but will contain descriptive text such as block, mark, etc. client The client IP Address of the protocol client. For SMTP this is the sender of the mail, and for IMAP/POP the receiver of the mail. For HTTP this is the address of the client browser machine. For FTP, this is the address of the machine receiving files. traffic This is a descriptive field identifying the type of traffic (HTTP, mail, etc). reason for action The reason the action was taken. server The server's IP address. For SMTP this is the machine receiving the email, and for IMAP/POP the machine holding the inbox. For HTTP this is the address of the server machine sending the document. For FTP this is the address of the machine transmitting the files being downloaded.
