Reset HAVP blocked list & allow certain files through

pftdm007

Hi,

HAVP is causing some problems here and I've searched the web without success. Seems that there is only a handful of HAVP users out there…

Basically, HAVP does its job too well! I have a machine that is running BOINC. Recently, I registered to a research project (similar to seti@home) and HAVP has kept blocking the files BOINC is trying to download, resulting in failure of the tasks.

the HAVP page on my pfsense box says:

10/10/2011 07:37:54	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 07:37:53	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 07:28:38	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 07:28:38	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 03:56:28	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 03:56:27	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 03:11:50	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 03:11:49	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 01:39:31	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 01:39:30	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 01:23:08	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 01:23:08	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 01:06:17	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 01:06:17	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 00:43:44	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
10/10/2011 00:43:41	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 00:30:27	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 00:29:47	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemdlong_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
10/10/2011 00:00:00	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemd2_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
09/10/2011 23:43:37	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
09/10/2011 23:31:30	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemd2_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
09/10/2011 23:16:45	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemd2_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
09/10/2011 23:16:45	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
09/10/2011 22:49:03	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
09/10/2011 22:49:02	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemd2_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
09/10/2011 22:41:59	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
09/10/2011 22:41:58	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemd2_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
09/10/2011 22:35:55	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable
09/10/2011 22:35:54	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/acemd2_6.14_x86_64-pc-linux-gnu__cuda31	Heuristics.Broken.Executable
09/10/2011 22:00:47	127.0.0.1	http://www.ps3grid.net/PS3GRID/download/libcufft.so.3.1.10	Heuristics.Broken.Executable

As you can see BOINC has tried to re-download the same files more than once and will keep trying..

Now to the questions:

I really doubt these files are viruses since they come from an open distributed computing project and must be scanned or somehow declared virus free. Plus I am the only one having this problem, with several hundred thousand members… I will still contact the admins to make sure these files are not viruses but in the meantime, how can I bypass HAVP (either temporarily or permanently)? I tried stopping HAVP and re-trying with BOINC, but somehow the files are still blocked, even if HAVP does not run. Probably Squid Cache. HAVP is parent of Squid here.

Second question: How can I purge/empty/clear the detected virus list of HAVP? There is no "clear" button.

I appreciate guidance.

Thanks to all!

dvserg

~~Try uncheck "Bock file if error scanning" option HAVP~~

Open /usr/local/pkg/havp.inc

Find string

    $conf[] = "DetectBrokenExecutables   yes";

And replace to

    $conf[] = "DetectBrokenExecutables   no";

Then open HAVP WEB GUI 'Settings' & 'HTTP Proxy' Tabs and click Save button's.

pftdm007

Unfortunately HAVP is still blocking the files.

I changed

$conf[] = "DetectBrokenExecutables yes";

to

$conf[] = "DetectBrokenExecutables no";

saved the file, and clicked Apply in the Settings tab of HAVP

Do I need to purge some kind of database or cache?

I also tried manually to download the files and I get a blocked page from HAVP:

HAVP - Access Denied

Access to the page has been denied

because the following virus was detected

Clamd: Heuristics.Broken.Executable

dvserg

@lpallard:

Unfortunately HAVP is still blocking the files.

I changed

$conf[] = "DetectBrokenExecutables yes";

to

$conf[] = "DetectBrokenExecutables no";

saved the file, and clicked Apply in the Settings tab of HAVP

Do I need to purge some kind of database or cache?

I think not. This is not DB function.

"

With this option clamav will try to detect broken executables (both PE and

ELF) and mark them as Broken.Executable.

Default: no

#DetectBrokenExecutables yes
"

pftdm007

Are you suggesting that I comment out the line

$conf[] = "DetectBrokenExecutables   no";

??

dvserg

http://kb.open-e.com/ClamAV-detected-HeuristicsBrokenExecutable_1123.html

Symptom:
Event viewer keeps notifying that ClamAV detected "Heuristics.Broken.Executable"

Problem:

The "Heuristics.Broken.Executable" error is shown when the ClamAV is not able to analyse a file.

Solution:

In order to disable the warnings about "Heuristics.Broken.Executable", apply the attached small update (upd_0830-DSS-V6.upd).
To apply a small update go to DSS webgui -> Maintenance -> software update and locate the file using "System software update" frame.
After applying the small update you need to reboot the DSS.
Additional information:
Small update upd_0830-DSS-V6.upd modifies the clamd.conf and changes DetectBrokenExecutables parameter to "no".

What, if reboot pfsense?

pftdm007

Rebooting did the trick! :)

Is it a big security threat if I keep the Heuristics.Broken.Executable parameter to NO

?

In other words, am I exposing myself to substantial threats?

dvserg

I think not. This is additional AV option for testing corrupted executable.

pftdm007

Thanks a lot for your help my friend!