Able to FTP a server viruses (!?)

[arboundy]

We have an FTP service that points to a virtual directory on a second machine.

I have noticed that I am able to FTP viruses (eicar) and they are accepted. They sit in my FTP folder and Inoculan does nothing until I touch the file in some way.

We are running Inoculan 6SP1 and I have ticked "scan alternative streams". I have been through the support.ca.com website - but really they should drop the word "support"!!

Does anyone know if there is a way to have Inoculan intercept the ftp stream realtime and reject the file? Or am I just missing something?

Thanks in advance.

 

[bkonline]

"Does anyone know if there is a way to have Inoculan intercept the ftp stream realtime and reject the file? "

anikan,
InoculateIT does not "intercept/reject" files based on mode of transfer such as ftp, http, etc...(i.e. to the best of my knowledge). Although it does have a "Quarantine" feature as part of the RealTime module. (Assuming you enabled the "Quarantine" option from the "filter" tab of the RealTime interface) But that only gets activated if it dictects a virus on the file being transmitted/copied. Also, when you try to install a software that writes to a sensitive part of the system, wiht Inoculate running, Realtime will intervine and deny access to all futher actions (even if you logged in as Administrator), in this case reboot becomes a necessary option.


^^^^^^^^^^^^^^^^^^^^^^^^^^
Experience is the Best Teacher
But its' cost is Heavy!
^^^^^^^^^^^^^^^^^^^^^^^^^^

 

[mohamdr]

Hi
I think you require content inspection
AV 7.0 comes with Content inspection Gateway option
which can take care of FTP,SMTP,etc
in case of ftp the gateway will download eicar and inspect it and if it is virus free it will send to the machine
which is donwloading it if it is contain virus it will inform the user that this files is infectd and it won't allow you to get it.
I don't think the other Antivirus venders doing it.

regards,
mohamdr