This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[v7.403]Malware detected

Hi All

There are couple of websites that astaro can't detect as spyware whereas my personal antivirus is.For example:
h**p://www.82zu.cn
h**p://www.fqwerz.cn/
h**p://www.goooogleadsence.biz/
h**p://94.247.2.195
h**p://www.d99q.cn/
h**p://www.orgsite.info/
h**p://www.lousecn.cn

The above urls are among the Top 10 Malware Sites as reported by Google

Any ideas of why ASG 7.403 can't detect them as malicious sites?

This thread was automatically locked due to age.

Parents

0 BAlfson over 16 years ago

When you say it doesn't detect them, what phenomenon do you observe that leads you to that conclusion?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 wingman over 16 years ago in reply to BAlfson

Well normall when I visit such a website, the site it's being blocked by saying Malicious Sites not allowed. (for example when trying to visit: h**p://googleanalytics.net/)
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to wingman

h**p://googleanalytics.net/ doesn't even exist for me. Nor does www.82zu.cn. I wonder if your personal tool is referencing a list of sites that includes some which no longer exist? That would cause it to flag a site even before attempting to run it through the Astaro. Check them on: Domain Dossier - Investigate domains and IP addresses, get owner and registrar information, see whois and DNS records

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 16 years ago in reply to wingman

This is what I am getting on 7.46 (sorry that is all I have at home). I was feeling a little brave so I disabled the categorization and Reputation check. None of the sites loaded besides the two below. Even then the avira scan got em[;)]. They are also listed as Malicious websites in content filter log.

fqwerz.cn... Blocked infected with HTML/Rce.Gen
d99q.cn... Blocked infected with HTML/Rce.Gen

The others didn't load.
Cancel
Vote Up 0 Vote Down

Cancel
0 wingman over 16 years ago in reply to BAlfson

h**p://googleanalytics.net/ doesn't even exist for me. Nor does www.82zu.cn. I wonder if your personal tool is referencing a list of sites that includes some which no longer exist? That would cause it to flag a site even before attempting to run it through the Astaro. Check them on: Domain Dossier - Investigate domains and IP addresses, get owner and registrar information, see whois and DNS records

Cheers - Bob

That's strange cause When I've tried them yesterday,there were all working fine.. I can confirm that few of them don't work anymore

However, running v7.404 (updated last night) still doesn't report those sites as infected.

fqwerz.cn...
d99q.cn...

It's my nod32 that blocks the traffic and not ASTARO (attached)

I am running pattern version 9915

The full list of the top 10 malwares is takes from : Google Online Security Blog: Top 10 Malware Sites
- fqwerz.cn.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 wingman over 16 years ago in reply to BAlfson

h**p://googleanalytics.net/ doesn't even exist for me. Nor does www.82zu.cn. I wonder if your personal tool is referencing a list of sites that includes some which no longer exist? That would cause it to flag a site even before attempting to run it through the Astaro. Check them on: Domain Dossier - Investigate domains and IP addresses, get owner and registrar information, see whois and DNS records

Cheers - Bob

That's strange cause When I've tried them yesterday,there were all working fine.. I can confirm that few of them don't work anymore

However, running v7.404 (updated last night) still doesn't report those sites as infected.

fqwerz.cn...
d99q.cn...

It's my nod32 that blocks the traffic and not ASTARO (attached)

I am running pattern version 9915

The full list of the top 10 malwares is takes from : Google Online Security Blog: Top 10 Malware Sites
- fqwerz.cn.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 BAlfson over 16 years ago in reply to wingman

Like I said, Wingman, I bet your software isn't blocking things from entering; it's blocking your requests to the sites. You had the impression the sites were active when they were already down. Billybob's experiment confirms that the Astaro is blocking when a site sends bad stuff.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 16 years ago in reply to BAlfson

Yeah, sounds like the NOD32 is blocking the requests before they "leave" the browser.... I can verify BillyBob's results. Everything is working as it should be.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 wingman over 16 years ago in reply to BrucekConvergent

thanks ppl for the clarification. I've tried it on a different computer that runs avast and indeed ASG blocks the websites
Cancel
Vote Up 0 Vote Down

Cancel