[v7.403]Malware detected

wingman · #1 (**permalink**) 06-25-2009, 10:36 PM

Hi All

There are couple of websites that astaro can't detect as spyware whereas my personal antivirus is.For example:
h**p://www.82zu.cn
h**p://www.fqwerz.cn/
h**p://www.goooogleadsence.biz/
h**p://94.247.2.195
h**p://www.d99q.cn/
h**p://www.orgsite.info/
h**p://www.lousecn.cn

The above urls are among the Top 10 Malware Sites as reported by Google

Any ideas of why ASG 7.403 can't detect them as malicious sites?

BAlfson · #2 (**permalink**) 06-25-2009, 10:46 PM

When you say it doesn't detect them, what phenomenon do you observe that leads you to that conclusion?

wingman · #3 (**permalink**) 06-25-2009, 10:56 PM

Well normall when I visit such a website, the site it's being blocked by saying Malicious Sites not allowed. (for example when trying to visit: h**p://googleanalytics.net/)

BAlfson · #4 (**permalink**) 06-25-2009, 11:23 PM

h**p://googleanalytics.net/ doesn't even exist for me. Nor does www.82zu.cn. I wonder if your personal tool is referencing a list of sites that includes some which no longer exist? That would cause it to flag a site even before attempting to run it through the Astaro. Check them on: Domain Dossier - Investigate domains and IP addresses, get owner and registrar information, see whois and DNS records

Cheers - Bob

Billybob · #5 (**permalink**) 06-25-2009, 11:51 PM

This is what I am getting on 7.46 (sorry that is all I have at home). I was feeling a little brave so I disabled the categorization and Reputation check. None of the sites loaded besides the two below. Even then the avira scan got em

. They are also listed as Malicious websites in content filter log.

fqwerz.cn... Blocked infected with HTML/Rce.Gen
d99q.cn... Blocked infected with HTML/Rce.Gen

The others didn't load.

wingman · #6 (**permalink**) 06-26-2009, 07:56 AM

Quote:

Originally Posted by BAlfson

h**p://googleanalytics.net/ doesn't even exist for me. Nor does www.82zu.cn. I wonder if your personal tool is referencing a list of sites that includes some which no longer exist? That would cause it to flag a site even before attempting to run it through the Astaro. Check them on: Domain Dossier - Investigate domains and IP addresses, get owner and registrar information, see whois and DNS records

Cheers - Bob

That's strange cause When I've tried them yesterday,there were all working fine.. I can confirm that few of them don't work anymore

However, running v7.404 (updated last night) still doesn't report those sites as infected.

fqwerz.cn...
d99q.cn...

It's my nod32 that blocks the traffic and not ASTARO (attached)

I am running pattern version 9915

The full list of the top 10 malwares is takes from : Google Online Security Blog: Top 10 Malware Sites

BAlfson · #7 (**permalink**) 06-26-2009, 01:56 PM

Like I said, Wingman, I bet your software isn't blocking things from entering; it's blocking your requests to the sites. You had the impression the sites were active when they were already down. Billybob's experiment confirms that the Astaro is blocking when a site sends bad stuff.

Cheers - Bob

BrucekConvergent · #8 (**permalink**) 06-26-2009, 03:33 PM

Yeah, sounds like the NOD32 is blocking the requests before they "leave" the browser.... I can verify BillyBob's results. Everything is working as it should be.

wingman · #9 (**permalink**) 06-26-2009, 06:30 PM

thanks ppl for the clarification. I've tried it on a different computer that runs avast and indeed ASG blocks the websites