cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 6

Archives not being scanned in MWG7

I noticed that some of the archive files are not being scanned by MWG7.3 and a normal download popup appears in Internet Explorer prompting for download.

From this site to be exact

http://www.csm-testcenter.org/test?do=show&subdo=antimalware&test=archives

Any help would be greatly appreciated.

Message was edited by: prajoshgeorge on 2/27/13 12:58:44 PM CST
5 Replies
Former Member
Not applicable
Report Inappropriate Content
Message 2 of 6

Re: Archives not being scanned in MWG7

Hi Prajoshgeorge!

Could you send a screenshot of your rules?

Perhaps you have the opener functionality turned off. The opener allows the MWG to look within objects.

Best,

Jon

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 6

Re: Archives not being scanned in MWG7

If you are refering to Common Rules -> Enable Opener -> Enable Composite Opener, It is already enabled (default).

It is set to run always for all cycles.

I noticed it happens to the below site as well

ftp://ftp.microsoft.com/softlib/MSLFILES

It seems to be the same issue with Web  Gateway 6.9.4.

Message was edited by: prajoshgeorge on 02/03/13 04:41:00 CST
Former Member
Not applicable
Report Inappropriate Content
Message 4 of 6

Re: Archives not being scanned in MWG7

Hi Prajosh,

What files are you testing with specifically? Also, how are you judging whether or not something was scanned? Purley based on whether or not you recieved a progress page or...?

On the csm-testcenter site there is encrypted archives mixed in there as well, so if you arent blocking encrypted content, that would explain why they are allowed.

I tested with my default configuration and the eicar virus was found for non-encrypted archives.

Best,

Jon

Former Member
Not applicable
Report Inappropriate Content
Message 5 of 6

Re: Archives not being scanned in MWG7

In your original response, I see you are saying that "the original IE prompt" is received, rather than the progress page.

Just because your get the IE download box, does not mean the MWG hasnt scanned the file. The MWG may have downloaded the file and scanned it, in less than the time you have set for displaying the progress page (its usually delayed by 5-10 seconds).

Best,

Jon

Former Member
Not applicable
Report Inappropriate Content
Message 6 of 6

Re: Archives not being scanned in MWG7

Thanks I will check that out. BTW how can I implement a rule to block corrupted archives?

I tried with the below rule

IsCorrupted.PNG

It seems to block all of the links on the right side on this website (arabic)

http://moi.gov.kw/portal/varabic/ShowPage.aspx?newsID=2523

213.132.241.10 "moi.gov.kw" 403 "-" 2147 5363 "POST http://moi.gov.kw/portal/varabic/ShowPage.aspx?newsID=2523 HTTP/1.1" "-" "-" 0 "Enable Opener/Block Corrupted MediaTypes" 22 "Media type blocked" false "-" false "-" "-" "http://moi.gov.kw/portal/varabic/ShowPage.aspx?newsID=2523"

When I turned off the rule the links started working.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community