Block infected files?

[#1]

All, I' m sure I' m missing something obvious here, but your help is genuinely appreciated. I am working with a Fortigate-50A, firmware 3.00-b0726(MR7). In the Protection Profile I' ve set up, I am performing Virus Scan on HTTP traffic. One of my users recently was allowed to download an infected exe file despite the fact that the FortiGate identified it as infected. I would prefer not to block all exe files since both Microsoft and our desktop anti-virus vendor periodically distribute updates with an exe extension. What am I missing? How can I tell the FortiGate 50A to block an infected file but allow clean files? Once again, thanks for the help! Chris

[abelio]

Hi,

In the Protection Profile I' ve set up, I am performing Virus Scan on HTTP traffic. One of my users recently was allowed to download an infected exe file despite the fact that the FortiGate identified it as infected.

could you post here the log message as printed by your FTG? " infected" really or ' suspicious' ?

What am I missing? How can I tell the FortiGate 50A to block an infected file but allow clean files?

Maybe (until you provide more information) the protection profile was not applied to firewall policy that your user traffic matched, maybe another thing. could you post the out of CLI command " show firewall profile <name_profile_you' ve_configured>" ?

[#3]

Here is the log entry (technically it is the Alert message that is sent, but it should provide the same information).

Message meets Alert condition Virus/Worm detected: Suspicious Protocol: " http" Source IP: 192.168.XXX.XXX Destination IP: 216.240.134.208 Email Address From: " N/A" Email Address To: " N/A" http://www.fortinet.com/ve?vn=Suspicious 2008-10-06 21:04:47 device_id=FGT50A2906500337 log_id=0211060000 type=virus subtype=infected pri=notice vd=root policyid=1 serial=307353 user=" N/A" group=" N/A" src=192.168.XXX.XXX sport=49511 src_int=" internal" dst=216.240.134.208 dport=80 dst_int=" external" service=" http" status=passthrough file=" A9installer_77075603.exe" virus=" Suspicious" url=" http://onlineprivatescan.com/2009/download/trial/A9installer_77075603.exe" ref=" http://www.fortinet.com/ve?vn=Suspicious" msg=" File is infected."

[#4]

And here is the profile:

config firewall profile edit " web" set httpoversizelimit 5 set ftpoversizelimit 5 set imapoversizelimit 5 set pop3oversizelimit 5 set smtpoversizelimit 5 set nntpoversizelimit 1 set log-ips enable set log-av-virus enable set log-av-block enable set log-web-content enable set log-web-url enable set ftp block scan splice set http block scan bannedword exemptword fortiguard-wf urlfilter set https urlfilter set imap block scan bannedword fragmail spamemailbwl spamfsip spamfssubmit spamfsurl spamhdrcheck spamipbwl spamraddrdns spamrbl set pop3 block scan bannedword fragmail spamemailbwl spamfsip spamfssubmit spamfsurl spamhdrcheck spamipbwl spamraddrdns spamrbl set smtp scan fragmail spamfssubmit splice set pop3-spamtagtype subject set filepattable 1 set weburlfiltertable 1 set spammheadertable 1 set spamrbltable 1 set spamiptrusttable 1 set nntp no-content-summary set ips-sensor-status enable set ips-sensor " all_default" unset im set p2p enable set bittorrent block set edonkey block set gnutella block set kazaa block set winny block set ftgd-wf-options http-err-detail rate-image-urls strict-blocking set ftgd-wf-https-options strict-blocking set ftgd-wf-allow 83 g03 g04 g06 g07 g08 g21 g22 c01 c02 c03 c04 c05 c06 set ftgd-wf-deny 1 2 3 4 5 6 57 58 59 60 61 62 g02 g05 next end

[#5]

Clearly the Alert message says " Suspicious." The final portion of the Alert, msg=" File is infected," is what led me to the conclusion that the file was infected. It is entirely possible that I' m simply ignorant, in which case I' m happy to learn! Any enlightenment provided is appreciated.

[abelio]

Hello, ' Suspicious' indicates just that. The AV engine of your FTG has a basic ' heuristic' feature; it' s basic in fortigates (not in fortimails) because it reacts to any windows executable files printing that label. If you follow the link http://www.fortinet.com/ve?vn=Suspicious you could get some info about that. In brief, you cannot ensure that' s an infected file or not; you would analyze ' A9installer_77075603.exe' file thereafter with some another tool. Heuristics is enabled by default in AV config, with the action ' pass' . You can modify its settings with CLI: " config antivirus heuristic" set mode {pass|block|disable} are the options.

[laf]

Hello, ' Suspicious' indicates just that. The AV engine of your FTG has a basic ' heuristic' feature; it' s basic in fortigates (not in fortimails) because it reacts to any windows executable files printing that label. If you follow the link http://www.fortinet.com/ve?vn=Suspicious you could get some info about that. In brief, you cannot ensure that' s an infected file or not; you would analyze ' A9installer_77075603.exe' file thereafter with some another tool. Heuristics is enabled by default in AV config, with the action ' pass' . You can modify its settings with CLI: " config antivirus heuristic" set mode {pass|block|disable} are the options.

Ok, so what would you recommend? Let it on and simply give me alerts, or simply turn it off. What do you do when do you have this kind of alerts? Another question: I have installed yesterday a FG60B with MR5, and playing in CLI i saw that grayware scanning was not enabled.....in MR6 is enabled or do Ive to manually enable it?

[abelio]

Ok, so what would you recommend? Let it on and simply give me alerts, or simply turn it off. What do you do when do you have this kind of alerts?

It depends on your traffic type; if you work with many windows executables and you' ve an excess of false positives, that is more a annoyance than a benefit. BTW, MR7 comes with ' heuristics' disabled by default. Personally, until Fortigates ' heuristics' doesn' t came with some capabilities like the FortiMail heuristics, i' ll turning it off . I' ll rely on another layers to protect the customer networks from executables.

Another question: I have installed yesterday a FG60B with MR5, and playing in CLI i saw that grayware scanning was not enabled.....in MR6 is enabled or do Ive to manually enable it?

Grayware scanning is enabled in a protection profile when virus scan is enabled. You have to enable the selected categories. In MR7 it comes disabled by default too.

[#9]

Thank you for the information!

[Kevin_Noble]

We also had trouble with our firewall letting these A9installer...exe files passthrough. I had to make sure the file limit size was set high enough to catch them (10MB should do it) and the other reasons they can passthrough is if you have different protection profiles enabled on the policy or do not have the File Filter settings clicked on in the protection profile you are using. You can see what policy ID you are using and then see what protection profile you have enabled on that policy. You also have to be sure that you have a file filter pattern setup on the protection profile - these are initially defined under the Antivirus section. You could also setup a file pattern to block a9*.* which may help as well as the *.exe. By the way you do want to block these - this is a nasty fake AV program that can be installed very easily since it generates popups that users may be tricked into clicking on and that is all it takes to download and install.