HTTP Virus Scanner in development?

Hi all,

picked up a nice Trojan "Backdoor-ACH" last friday which is more or less an Advanced B02K. Not a new Trojan, but an effective program.

The Installation Routine started with a HTML page that was loaded (JAVA) which then connected to an external server and installed the Server component of the Backdoor-ACH Trojan, started it as a service, sent my logged on user, ip, system status and other info to an Email Address, without any messages what so ever.

Fortunately the Server component waits for a connection and ASL doesnt let that happen so no damage was done (not yet ). It also deactivated my local Firewall and AV Scanner so without the ASL i would have been rooted.

now the question. since the ASL is my HTTP Proxy this would be the logical place to place a HTTP scanner.

does astaro have any plans to integrate one? Can anyone recommend one?

Parents

0 Jan Hichert over 23 years ago

Tmor,

we also think HTTP Virus Protection would be a top notch feature on ASL. Unfortunately we are not aware of any working projects here.

Has anyone made experiences here? Any commercial/OS products you could recommend?

Thanks for your feedback,
Jan
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Jan Hichert over 23 years ago

Tmor,

we also think HTTP Virus Protection would be a top notch feature on ASL. Unfortunately we are not aware of any working projects here.

Has anyone made experiences here? Any commercial/OS products you could recommend?

Thanks for your feedback,
Jan
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 Jaime Nebrera over 23 years ago in reply to Jan Hichert

Hi there:

  There are two OS projects regarding AV in HTTP.

  The first one is Viralator and is made in Perl. Its known to work but has some sharp corners and you know, Perl might not be the best choice.

  The second one that I know of is squid-vscan. Its made in C but in a very early stage of development. It is a project of Open Antivirus. Seems to be the best way to go for the future. It shouldn't be hard to hook it with AVP so all the virus system would go with the same antivirus engine (SMTP, POP, and HTTP).

  Hope it helps.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 antares over 23 years ago in reply to Jaime Nebrera

Hi,
we are using the Trendmicro Viruswall. If someone is looking for a commercial solution give it a try. They have 30 days trial for tests. It's running on Windows or Linux and scans http, ftp and smtp traffic. We have tested it on several Win boxes without problems. One installtion on Linux (SuSE) is running since few month without any problems. Haven't had the time to test if it could run on the asl box. But if you have a proxy or mailserver in the dmz this would be the better place in my opinion.

Wolfgang
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 davidgranlund over 23 years ago in reply to antares

You could try out Symantecs Security Gateway Appliance. We have evaluated one at my work, and it seemed to do what its supposed to. If it wouldn't have been for the colour we might have considered purchasing one.. :-)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Vukasin over 23 years ago in reply to davidgranlund

http://www.astaro.org/ubb/ultimatebb.php?ubb=get_topic;f=2;t=001184
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel