Virus Blocker Common FAQs - Revision history

Græmer: /* Why does the Event Log say a file is blocked, but I can still download it? */

2022-05-03T18:43:12Z

Why does the Event Log say a file is blocked, but I can still download it?

← Older revision		Revision as of 18:43, 3 May 2022
Line 21:		Line 21:
	=== Why does the Event Log say a file is blocked, but I can still download it? ===		=== Why does the Event Log say a file is blocked, but I can still download it? ===

	When downloading over the web small files are blocked with a block page. Larger files are treated differently. They are fed to the client at a slower rate than they are actually downloaded so the client does not time out while the download happens. After ~~Untangle~~ scans the complete file it will either refuse to send the rest if there is a virus or immediately send the rest. This means for large files the Event Log says the file is "blocked", but checking the file size on the client will show that you do not actually have the complete file.		When downloading over the web small files are blocked with a block page. Larger files are treated differently. They are fed to the client at a slower rate than they are actually downloaded so the client does not time out while the download happens. After NG Firewall scans the complete file it will either refuse to send the rest if there is a virus or immediately send the rest. This means for large files the Event Log says the file is "blocked", but checking the file size on the client will show that you do not actually have the complete file.

Græmer: /* Why do emails with larger attachments sometimes "disappear" or are not delivered? */

2022-05-03T18:43:04Z

Why do emails with larger attachments sometimes "disappear" or are not delivered?

← Older revision		Revision as of 18:43, 3 May 2022
Line 17:		Line 17:
	=== Why do emails with larger attachments sometimes "disappear" or are not delivered? ===		=== Why do emails with larger attachments sometimes "disappear" or are not delivered? ===

	While ~~Untangle~~ is scanning the attachments your email server is still waiting for the message, most likely triggering a timeout setting. If you're using MS Exchange, you'll want to increase the '''ConnectionInactivityTimeout''' setting.		While NG Firewall is scanning the attachments your email server is still waiting for the message, most likely triggering a timeout setting. If you're using MS Exchange, you'll want to increase the '''ConnectionInactivityTimeout''' setting.


	=== Why does the Event Log say a file is blocked, but I can still download it? ===		=== Why does the Event Log say a file is blocked, but I can still download it? ===

	When downloading over the web small files are blocked with a block page. Larger files are treated differently. They are fed to the client at a slower rate than they are actually downloaded so the client does not time out while the download happens. After Untangle scans the complete file it will either refuse to send the rest if there is a virus or immediately send the rest. This means for large files the Event Log says the file is "blocked", but checking the file size on the client will show that you do not actually have the complete file.		When downloading over the web small files are blocked with a block page. Larger files are treated differently. They are fed to the client at a slower rate than they are actually downloaded so the client does not time out while the download happens. After Untangle scans the complete file it will either refuse to send the rest if there is a virus or immediately send the rest. This means for large files the Event Log says the file is "blocked", but checking the file size on the client will show that you do not actually have the complete file.

Græmer: /* How can I test that viruses are being blocked? */

2022-05-03T18:42:57Z

How can I test that viruses are being blocked?

← Older revision		Revision as of 18:42, 3 May 2022
Line 12:		Line 12:
	=== How can I test that viruses are being blocked? ===		=== How can I test that viruses are being blocked? ===

	An easy way to test HTTP virus scanning is to download the [http://2016.eicar.org/download/eicar.com eicar test] from a machine behind ~~Untangle~~.		An easy way to test HTTP virus scanning is to download the [http://2016.eicar.org/download/eicar.com eicar test] from a machine behind NG Firewall.
	If virus scanning is not working the file will download successfully (it is harmless). If it is working a block page will be displayed.		If virus scanning is not working the file will download successfully (it is harmless). If it is working a block page will be displayed.

Græmer: /* If I have Virus Blocker and Virus Blocker Lite installed, are one or both used and in which order? */

2022-05-03T18:42:45Z

If I have Virus Blocker and Virus Blocker Lite installed, are one or both used and in which order?

← Older revision		Revision as of 18:42, 3 May 2022
Line 8:		Line 8:
	=== If I have Virus Blocker '''and''' Virus Blocker Lite installed, are one or both used and in which order? ===		=== If I have Virus Blocker '''and''' Virus Blocker Lite installed, are one or both used and in which order? ===

	If you have both virus scanners installed, Virus Blocker is applied to a message first: if a message passes Virus Blocker, then and only then is Virus Blocker Lite applied to the message (there's no point in scanning the message twice if the first scanner has rejected it). This is not to say one scanner is inherently better than the another: note that Virus Blocker is '''complemented''' by Virus Blocker Lite and in the case of a virus-free message, the computational overhead of the virus scan includes '''both''' scanners. A message that would be rejected by both scanners incurs the computational and time cost of just Virus Blocker. To perform a valid comparison, you should run test messages through the ~~Untangle~~ with no scanners installed, Virus Blocker by itself, Virus Blocker Lite by itself and lastly both scanners installed together and compare the results.		If you have both virus scanners installed, Virus Blocker is applied to a message first: if a message passes Virus Blocker, then and only then is Virus Blocker Lite applied to the message (there's no point in scanning the message twice if the first scanner has rejected it). This is not to say one scanner is inherently better than the another: note that Virus Blocker is '''complemented''' by Virus Blocker Lite and in the case of a virus-free message, the computational overhead of the virus scan includes '''both''' scanners. A message that would be rejected by both scanners incurs the computational and time cost of just Virus Blocker. To perform a valid comparison, you should run test messages through the NG Firewall with no scanners installed, Virus Blocker by itself, Virus Blocker Lite by itself and lastly both scanners installed together and compare the results.


	=== How can I test that viruses are being blocked? ===		=== How can I test that viruses are being blocked? ===

Græmer: /* If I use Untangle, do I need to install virus software on individual network computers? */

2022-05-03T18:42:36Z

If I use Untangle, do I need to install virus software on individual network computers?

← Older revision		Revision as of 18:42, 3 May 2022
Line 2:		Line 2:


	=== If I use ~~Untangle~~, do I need to install virus software on individual network computers? ===		=== If I use NG Firewall, do I need to install virus software on individual network computers? ===

	We recommend an additional layer of protection on the desktop. Virus Blocker and Virus Blocker Lite scan HTTP, FTP, SMTP, and HTTPS if you are running SSL Inspector. However, there are many other ways for malware to enter the network such as through other protocols or encrypted tunnels or through physical means like a USB key.

			We recommend an additional layer of protection on the desktop. Virus Blocker and Virus Blocker Lite scan HTTP, FTP, SMTP, and HTTPS if you are running SSL Inspector. However, there are many other ways for malware to enter the network such as through other protocols or encrypted tunnels or through physical means like a USB key.

	=== If I have Virus Blocker '''and''' Virus Blocker Lite installed, are one or both used and in which order? ===		=== If I have Virus Blocker '''and''' Virus Blocker Lite installed, are one or both used and in which order? ===

Jcoffin: /* How can I test that viruses are being blocked? */

2020-06-02T16:13:27Z

How can I test that viruses are being blocked?

← Older revision		Revision as of 16:13, 2 June 2020
Line 14:		Line 14:
	=== How can I test that viruses are being blocked? ===		=== How can I test that viruses are being blocked? ===

	An easy way to test HTTP virus scanning is to download the [http://~~www~~.eicar.org/download/eicar.com eicar test] from a machine behind Untangle.		An easy way to test HTTP virus scanning is to download the [http://2016.eicar.org/download/eicar.com eicar test] from a machine behind Untangle.
	If virus scanning is not working the file will download successfully (it is harmless). If it is working a block page will be displayed.		If virus scanning is not working the file will download successfully (it is harmless). If it is working a block page will be displayed.


	=== Why do emails with larger attachments sometimes "disappear" or are not delivered? ===		=== Why do emails with larger attachments sometimes "disappear" or are not delivered? ===

Dmorris at 18:02, 12 February 2016

2016-02-12T18:02:24Z

New page

[[Category:FAQs]]

=== If I use Untangle, do I need to install virus software on individual network computers? ===

We recommend an additional layer of protection on the desktop. Virus Blocker and Virus Blocker Lite scan HTTP, FTP, SMTP, and HTTPS if you are running SSL Inspector. However, there are many other ways for malware to enter the network such as through other protocols or encrypted tunnels or through physical means like a USB key.

=== If I have Virus Blocker '''and''' Virus Blocker Lite installed, are one or both used and in which order? ===

If you have both virus scanners installed, Virus Blocker is applied to a message first: if a message passes Virus Blocker, then and only then is Virus Blocker Lite applied to the message (there's no point in scanning the message twice if the first scanner has rejected it). This is not to say one scanner is inherently better than the another: note that Virus Blocker is '''complemented''' by Virus Blocker Lite and in the case of a virus-free message, the computational overhead of the virus scan includes '''both''' scanners. A message that would be rejected by both scanners incurs the computational and time cost of just Virus Blocker. To perform a valid comparison, you should run test messages through the Untangle with no scanners installed, Virus Blocker by itself, Virus Blocker Lite by itself and lastly both scanners installed together and compare the results.

=== How can I test that viruses are being blocked? ===

An easy way to test HTTP virus scanning is to download the [http://www.eicar.org/download/eicar.com eicar test] from a machine behind Untangle.
If virus scanning is not working the file will download successfully (it is harmless). If it is working a block page will be displayed.

=== Why do emails with larger attachments sometimes "disappear" or are not delivered? ===

While Untangle is scanning the attachments your email server is still waiting for the message, most likely triggering a timeout setting. If you're using MS Exchange, you'll want to increase the '''ConnectionInactivityTimeout''' setting.

=== Why does the Event Log say a file is blocked, but I can still download it? ===

When downloading over the web small files are blocked with a block page. Larger files are treated differently. They are fed to the client at a slower rate than they are actually downloaded so the client does not time out while the download happens. After Untangle scans the complete file it will either refuse to send the rest if there is a virus or immediately send the rest. This means for large files the Event Log says the file is "blocked", but checking the file size on the client will show that you do not actually have the complete file.