Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Anti virus Fails eicar test file

    Scheduled Pinned Locked Moved Cache/Proxy
    21 Posts 3 Posters 8.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Netizen1
      last edited by

      @firefox:

      i have version 0.3.8
      when is this  version Is distributed ?

      As soon as the pull request doktornotor quoted gets approved and merged… no ETA at this point

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by

        Try with 0.3.9.1

        1 Reply Last reply Reply Quote 0
        • F
          firefox
          last edited by

          After the update, and after it runs
          Still Fails

          it this website ?

          http://www.eicar.org/85-0-Download.html

          i try to download this files
          and they are downloaded
          no any virus Message

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            Clear your browser cache. All I can suggest. When it's cached locally, won't hit Squid at all.

            1 Reply Last reply Reply Quote 0
            • F
              firefox
              last edited by

              i  Clear my browser cache
              and try from another computer

              and just delete squid cache

              still cant see the virus

              Could be
              Something in the settings squid

              home.plex_-Proxy_Server_Access_Control-_2015-10-10_14.18.46.png
              home.plex_-Proxy_Server_Access_Control-_2015-10-10_14.18.46.png_thumb
              home.plex_-Proxy_server_Traffic_Management-_2015-10-10_14.18.07.png
              home.plex_-Proxy_server_Traffic_Management-_2015-10-10_14.18.07.png_thumb

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                Dude. This just works, as shown on the screenshots above.

                • The ACLs have no relevance as long as you keep the Allow Users on Interface checked.
                • The Traffic Mgmt is totally irrelevant

                The only relevant things here is that

                • Antivirus is enabled an running
                • The file is not cached locally by the browser
                • The request hits the proxy (i.e., your browser is configured to use the proxy)

                Check the logs to see whether that requests goes to Squid or not. Its shown realtime. Use the damned logs. They are there for a reason.

                1 Reply Last reply Reply Quote 0
                • F
                  firefox
                  last edited by

                  The only relevant things here is that

                  • Antivirus is enabled an running
                  • The file is not cached locally by the browser
                  • The request hits the proxy (i.e., your browser is configured to use the proxy)

                  Antivirus is enabled an running – yes
                  The file is not cached locally by the browser -- How do I check it ?
                  The request hits the proxy (i.e., your browser is configured to use the proxy) yes

                  Check the logs to see whether that requests goes to Squid or not. Its shown realtime. Use the damned logs. They are there for a reason.

                  real time dont show notting
                  i try my ip

                  what is

                  damned logs

                  dont see this tab

                  ![Screenshot from 2015-10-10 15:20:20.png](/public/imported_attachments/1/Screenshot from 2015-10-10 15:20:20.png)
                  ![Screenshot from 2015-10-10 15:20:20.png_thumb](/public/imported_attachments/1/Screenshot from 2015-10-10 15:20:20.png_thumb)
                  ![Screenshot from 2015-10-10 15:27:39.png](/public/imported_attachments/1/Screenshot from 2015-10-10 15:27:39.png)
                  ![Screenshot from 2015-10-10 15:27:39.png_thumb](/public/imported_attachments/1/Screenshot from 2015-10-10 15:27:39.png_thumb)
                  ![Screenshot from 2015-10-10 15:29:03.png](/public/imported_attachments/1/Screenshot from 2015-10-10 15:29:03.png)
                  ![Screenshot from 2015-10-10 15:29:03.png_thumb](/public/imported_attachments/1/Screenshot from 2015-10-10 15:29:03.png_thumb)
                  ![Screenshot from 2015-10-10 15:31:08.png](/public/imported_attachments/1/Screenshot from 2015-10-10 15:31:08.png)
                  ![Screenshot from 2015-10-10 15:31:08.png_thumb](/public/imported_attachments/1/Screenshot from 2015-10-10 15:31:08.png_thumb)
                  ![Screenshot from 2015-10-10 15:33:02.png](/public/imported_attachments/1/Screenshot from 2015-10-10 15:33:02.png)
                  ![Screenshot from 2015-10-10 15:33:02.png_thumb](/public/imported_attachments/1/Screenshot from 2015-10-10 15:33:02.png_thumb)

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    Auto-Detect proxy does absolutely NOTHING useful without DHCP/DNS/WPAD configuration. Unless Squid is configured as transparent, those requests will not ever hit the proxy. Which very much corresponds with your observation that "real time dont show notting".

                    1 Reply Last reply Reply Quote 0
                    • F
                      firefox
                      last edited by

                      Auto-Detect proxy does absolutely NOTHING useful without DHCP/DNS/WPAD configuration

                      It was on "use system proxy settings"
                      I changed it
                      I wanted to see if that would help

                      Unless Squid is configured as transparent, those requests will not ever hit the proxy.

                      squid not configured as transparent (I tried it – There was no Internet access)

                      Which very much corresponds with your observation that "real time dont show notting

                      how do i make it work
                      it work before (dont remember the last time I checked, the date I mean)

                      what is

                      damned logs

                      where i can see it ?

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        Kindly explicitly point your browser to you pfSense LAN IP port 3128 in the proxy settings. Proxy autoconfiguration will not work without setting up things as mentioned above.

                        1 Reply Last reply Reply Quote 0
                        • F
                          firefox
                          last edited by

                          like this ?

                          ![Screenshot from 2015-10-10 16:12:18.png](/public/imported_attachments/1/Screenshot from 2015-10-10 16:12:18.png)
                          ![Screenshot from 2015-10-10 16:12:18.png_thumb](/public/imported_attachments/1/Screenshot from 2015-10-10 16:12:18.png_thumb)

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by

                            No, NOT like this. You cannot leave the field before the port empty!!!

                            1 Reply Last reply Reply Quote 0
                            • F
                              firefox
                              last edited by

                              You cannot leave the field before the port empty!!!

                              What should be listed there ?

                              Thanks for your help and patience

                              1 Reply Last reply Reply Quote 0
                              • D
                                doktornotor Banned
                                last edited by

                                @firefox:

                                You cannot leave the field before the port empty!!!

                                What should be listed there ?

                                Urgh!!!! I already answered that question!!!

                                @doktornotor:

                                Kindly explicitly point your browser to your pfSense LAN IP port 3128 in the proxy settings.

                                1 Reply Last reply Reply Quote 0
                                • F
                                  firefox
                                  last edited by

                                  i did it but
                                  when it was like that
                                  i had no internet access
                                  not even to the pfsense 192.168.0.1

                                  ![Screenshot from 2015-10-10 16:43:30.png_thumb](/public/imported_attachments/1/Screenshot from 2015-10-10 16:43:30.png_thumb)
                                  ![Screenshot from 2015-10-10 16:43:30.png](/public/imported_attachments/1/Screenshot from 2015-10-10 16:43:30.png)

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by

                                    OK. I seriously do NOT have time for this any more. Maybe someone else has the patience to explain how to configure a proxy in browser in 2-pages thread. I don't any more. This gets hazardous to my health and mental sanity.

                                    FUCKING HELL: Type the IP adress there!!! Of the pfSense LAN. "pfSense LAN IP" is not a valid IP address!!! WTH!!!!!!!!!!!  Google how IP address looks if unsure!

                                    :( >:( >:( >:( >:( >:( >:( >:( >:( >:(

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      firefox
                                      last edited by

                                      It works finally

                                      Thank you

                                      Before
                                      I did not have to write this information,
                                      And it worked

                                      Anyway
                                      Thanks again

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        doktornotor Banned
                                        last edited by

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.