[9.070][CLOSED] AV unable to detect virus to dropbox

Hello ,

using Transparent Mode but dropbox configure with proxy utmip and port 8080

using dropbox in appcontrol

i have many samples of virus which i downloaded to my linux pc and from that i am able to upload to dropbox while http proxy is on

and i also notice that if i upload big virus file database restart

2013:03:05-20:02:14 acenn httpproxy[30947]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="192.168.7.125" dstip="199.47.216.147" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="15" request="0x13801cb0" url="notify5.dropbox.com:80/subscribe

2013:03:05-20:02:53 acenn httpproxy[30947]: id="0003" severity="info" sys="SecureWeb" sub="http" request="(nil)" function="sc_check_servers" file="scr_scanner.c" line="754" message="server 'cffs15.astaro.com' access time: 198ms"

but if i download same file from dropbox it able to detect virus

please correct me if i am wrong

thanks

Parents

0 Tinkerbell over 12 years ago

I noticed those logs too. But if you check the box for Scan HTTPS (SSL) Traffic then if you upload a virus in Dropbox account via web, the content will be blocked. Dropbox uses HTTPS.

2013:03:07-15:53:18 bpo-asg-02 httpproxy[10608]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="POST" srcip="10.145.16.218" dstip="" user="" statuscode="403" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2464" request="0xabfa258" url="dl-web.dropbox.com/upload" exceptions="" error="" country="United States" reputation="trusted" category="170" reputation="trusted" categoryname="Personal Network Storage" engine="SAVI" virus="EICAR-AV-Test"

Or did you upload using the Dropbox client application?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 utm_kid over 12 years ago in reply to Tinkerbell

i  am using ubuntu linux  12.04.2, from /home/download (or document)folder "copy files"  to /home/dropbox then sync will upload file to dropbox web site   for download i am using dropbox application right click launch dropbox web site
i am using https ,Scan HTTPS (SSL) Traffic is checked

can you also check  file extenstion blocking when file extenstion block by web filtering>> antivirus/malware>> File extension filter

http://notify5.dropbox.com:80 use port 80 not port 443

think of data leak also  not just virus

if possible can you pls tell me how do you dropbox to upload file using brower (never tryed)
edit :quick quastion : is Block downloads larger than size support upload or just download (new feature in http proxy/adv >misc)

thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 utm_kid over 12 years ago in reply to Tinkerbell

i  am using ubuntu linux  12.04.2, from /home/download (or document)folder "copy files"  to /home/dropbox then sync will upload file to dropbox web site   for download i am using dropbox application right click launch dropbox web site
i am using https ,Scan HTTPS (SSL) Traffic is checked

can you also check  file extenstion blocking when file extenstion block by web filtering>> antivirus/malware>> File extension filter

http://notify5.dropbox.com:80 use port 80 not port 443

think of data leak also  not just virus

if possible can you pls tell me how do you dropbox to upload file using brower (never tryed)
edit :quick quastion : is Block downloads larger than size support upload or just download (new feature in http proxy/adv >misc)

thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 utm_kid over 12 years ago in reply to utm_kid

pls check image for proxy setting ,for better understanding writen in 1st post
- proxy.jpeg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 utm_kid over 12 years ago in reply to utm_kid

ok understood what you mean by brower based upload with brower based upload but i am using clinet with http proxy

2013:03:07-23:03:11 acenn httpproxy[26552]: id="0056" severity="info" sys="SecureWeb" sub="http" name="web request blocked, virus detected" action="block" method="POST" srcip="192.168.7.125" dstip="" user="" statuscode="403" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="2468" request="0x13eea4b0" url="dl-web.dropbox.com/.../Agent-QF"
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[9.070][CLOSED] AV unable to detect virus to dropbox

Submitted a Tech Support Case lately from the Support Portal?