Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Culpeper on March 19, 2005, 04:41:52 AM
-
????
-
This is a very good question for which I have no answer at the moment.
Maybe the Avast Team will jump in on this one.
The Web Shield monitors and filters all HTTP traffic coming from the Web sites on the Internet for an increasing number of viruses (and other malware, such as adware, spyware and dialers).
The only way I can think of to test it, is to go to a site known to download "crap"
If you have Adaware or Spybot, look in their data list for a site and try it.
-
Try downloading the Eicar test virus at http://www.eicar.org/anti_virus_test_file.htm and watch avast! light up. Or anything from one of the warez/crackz type sites if you are confident.
-
Webshield is a nice addition to Avast. I'm still using CA Etrust though. For some reason I like the dull simplicity of it. :-X And my WinXP volume icon is back. That is a bug with WinXP though. I'm obssessed with that volume icon in the taskbar. If I install software and the icon disappears because of it then I normally uninstall the software and the the icon returns. If the new software is not compatible with the volume icon in the taskbar then out goes the new software. Like I said, I'm obssessed with the volume icon. I can stare it for hours on end.
-
Is this what you're talking about: http://support.microsoft.com/kb/279435/EN-US/ ?
The icon is cool but - are you joking? You can stare at it for hours? ;D
-
Aye matey! Dat be da one!
There's a bug in WinXP where the volume icon is concerned. The icon is not set to show in the taskbar on startup but if you select it to do so, in some cases, you may have a problem with it disappearing entirely. The web is full of posts with XP users complaining about their volume icon disappearing to no avail.
I think I will keep Avast! on my Win98 machine until my subscription runs out on Etrust at which point I'll migrate Avast! to my WinXP machine. I hate to dump Avast! entirely just because of my obssession with the the WinXP volume icon in the taskbar. I do love that icon.
-
Click here (http://www.eicar.org/download/eicar.com) to download the eicar test...
If nothing happens, well, your WebShield is not well configurated :-\
-
Hey Technical et al, any AV program will alarm on that EICAR test file. What would be cool is a website to test the effectiveness of the "webshield" for what it is designed to prevent or protect against. Seems Awil should already have a test web page with harmless stuff on there to sound off the webshield sonar. Going around looking for dangerous web pages just to test the webshield is a little dangerous. But, what else are pirates for?
-
Hey Technical et al, any AV program will alarm on that EICAR test file. What would be cool is a website to test the effectiveness of the "webshield" for what it is designed to prevent or protect against. Seems Awil should already have a test web page with harmless stuff on there to sound off the webshield sonar. Going around looking for dangerous web pages just to test the webshield is a little dangerous. But, what else are pirates for?
I've tested myself four or five times... Infected files (downloaded) were on my Chest, they would not even saved in my HD (like it should be) 8)
-
Still want a comprehensive web page to test the webshield. "My kingdom for a horse."
-
I turned off my firewall on machine where i run web server and there was not 5 minutes when avast web shield anwser...
-
Best way to test Web Shield is to download ZIP version of EICAR. You can also try with double zipped EICAR. These files are normally not detected by avast! with disabled Web Shield.
-
Best way to test Web Shield is to download ZIP version of EICAR. You can also try with double zipped EICAR. These files are normally not detected by avast! with disabled Web Shield.
You know what? That doesn't make any sense since any other anti-virus program should sound off to an EICAR file with or without a so-called "webshield." I am beginning to think most users don't even understand what the developers meant by adding on the new "webshield" provider. Every test I was recommended in this thread would be caught by any standard resident shield on any AV program.
And what does this mean..." I turned off my firewall on machine where i run web server and there was not 5 minutes when avast web shield answer..." Why would you stop halfway through the detail? I'm not going to fill in the blanks.
I'm sure the webshield works like it is intended to do but I'm not getting any satisfaction on testing it out because there is nothing to test with. I guess I will keep an eye out for a published review or something.
Year ago I used a version of PC-illin that had a so-called "webshield" and it worked fine but you never new it because there was really no way to test it. It just kept a vigil for what it would consider hostile scripts.
The Avast webshield has to be something above and beyond basic in the wild virus protection. It scans html and such while your viewing the page your pointing at.
From the Avast website:
Web Shield
The main highlight of avast 4.6 is undoubtly the new avast! on-access scanning provider - Web Shield. It is able to monitor and filter all HTTP traffic coming from the Web sites on the Internet. Since an increasing number of viruses (and other malware, such as adware, spyware and dialers) are being distributed via the World Wide Web, the need for an effective countermeasures has also increased. The Web Shield acts as a transparent HTTP proxy and is compatible with all major web browsers, including Microsoft Internet Explorer, FireFox, Mozilla and Opera.
Unlike most competitive solutions, the Web Shield's impact on browsing speed is almost negligible. This is because of a unique feature called "Intelligent Stream Scan" that lets the Web Shield module scan objects on-the-fly, without the need of caching them locally. Stream scanning is performed in operating memory only (without the necessity to flush the contents to disk), providing maximum possible throughput rates.
-
You know what? That doesn't make any sense since any other anti-virus program should sound off to an EICAR file with or without a so-called "webshield."
That is the only way. Do you think a normal user has access to viruses or even wants to be connected to them? One single infection and I consider doing a reformat!!!
You can see after doing that test that it is indeed WebShield and not the Standard shield that grabs the virus first before it reaches your browser.
And what does this mean..." I turned off my firewall on machine where i run web server and there was not 5 minutes when avast web shield answer..."
This is not a case of a virusinfection warning or webshield I think. It was another Avast component called 'Network Shield' that is not a virusscanner. Useful to have to remind that your firewall is not doing it's job.
-
What's the point of the webshield if a basic standard shield is enough protection? That would amount to wasting resources on the machine. Not with redundant protection but duplicate protection. Just call one a standard resident shield and the other webshield? No, I still believe the developers have something else in mind where the webshield provider is concerned and I'm sure there are ways to test it. Just like there are ways to test a firewall.
-
Web Shield checks all HTTP traffic including archived files (most common web infectors are JAR archives with payload). This is very useful for content that is not cached,but rendered directly. Standard On-Access providers of many antiviruses simply don't scan archives because they make way too high overhead. Web Shield avoids this issue and scans only the most important data that is transmitted from the web.
Such files are those JAR (JS) that i mentioned before and JPEG exploited images.
The main difference between Web Shield and Standard Shield is this:
Standard Shield example
Web -> Browser -> Standard Shield
(data is scanned when it's already passed through browser)
Standard Shield example
Web -> Web Shield -> Browser -> Standard Shield
Now do you see the differene? All data is fist checked and then passed to Browser,and if the data is cached it can be also checked by Standard Shield.
So there is much smaller chance of getting infected by some exploit if the data is scanned before it actually hits the browser itself.
-
The idea of the web shield is to scan the http stream, to detect any possible virus infection before it has time to get established on the HDD.
Rather than wait until it has downloaded and placed itself in one of the windows system folders, created a registry entry, etc. etc. This is mainly due to people browsing the web with administrator privileges which allows the virus the same priviliges.
Prevention has got to be beter than cure.
When you attempt to download the eicar.com test file it should be picked up by the web shield and it offers the option to abort the connection (just that item being downloaded, not the dial-up or broadband connection). Doing that stops it in its tracks, it doesn't get on your HDD, so there is a way to test web shield by clicking on the link that Technical gave you.
-
I can confirm the two previous posts: before Webshield I used to get a lot of exploits and Trojans in my Java cache. AVG used to detect them during a system scan, and avast! 4.5 would sometimes detect them when they had passed through the browser and into the Java cache on the hard disk.
Now with avast! 4.6 and webshield, this malware is intercepted before it has a chance to get on my hard disk. (As a previous post said, before it even reaches the browser).
All this malware was not dangerous anyway, because it was designed to attack the Microsoft Virtual Machine, and doesn't affect the Java Run Time environment. But I think this is a valid real-world test of Webshield: it blocked malware which could have installed a Trojan on a system with an old version of IE vulnerable to this exploit.
Of course the real test of Webshield will be when a new browser or browser plug-in security vulnerability gives rise to a new malware attack: if the Webshield definitions are updated quickly enough and it manages to block the new malware before security updates have been issed, that'll be a real success.
-
Will Webshield block the Java applet Trojan currently targeting alternative browsers?
That would be an interesting test. (The Trojan relies on users clicking 'yes' to a Java applet despite security warnings.)
http://www.edbott.com/weblog/archives/000562.html
http://www.f-secure.com/v-descs/openstream_t.shtml
-
Of course the real test of Webshield will be when a new browser or browser plug-in security vulnerability gives rise to a new malware attack: if the Webshield definitions are updated quickly enough and it manages to block the new malware before security updates have been issed, that'll be a real success.
Could WebShield be based on Heuristics and not only on signatures?
-
Will Webshield block the Java applet Trojan currently targeting alternative browsers?
That would be an interesting test. (The Trojan relies on users clicking 'yes' to a Java applet despite security warnings.)
http://www.edbott.com/weblog/archives/000562.html
http://www.f-secure.com/v-descs/openstream_t.shtml
This is exactly what I am talking about. Thanks!
-
Will Webshield block the Java applet Trojan currently targeting alternative browsers?
That spyware/Trojan is targeting all browsers ;)
Could WebShield be based on Heuristics and not only on signatures?
i doubt this, as Malware can be tweaked to bypass Heuristics quite easily if i understand right.
Most likely it is based on definition files and generic files.
--lee
-
If heuristics can be bypassed so easily,then why NOD32,ArcaVir,BitDefender and some others can detect majority of stuff with it? Including new worms?
-
If heuristics can be bypassed so easily,then why NOD32,ArcaVir,BitDefender and some others can detect majority of stuff with it? Including new worms?
Because they wern't tweaked for them specificly, if a hacker or virus/malware maker anted he could tweak it for one or more scanners.
Anyway, i was just rewording what Vlk said:
On a side note, heuristic detection has one major flaw that is often overlooked. That is, every virus writer in the world can download the scanner and fine-tune the virus so that it goes undetected. And it's often pretty simple to do so -- tweaking a couple of instructions and here we go! Therefore, I'm personally not a big believer in heuristic detection - it's just too fragile (in this sense, being a relatively small vendor actually helps - virus writers may test their code with most common scanners but fail to test them with the rest).
Source: Reply 9 here: http://forum.avast.com/index.php?topic=4979.0
--lee
-
"That spyware/Trojan is targeting all browsers"
Yes, indeed it is, but using different methods. The Java applet Trojan installer targets alternative browsers. IE is targeted by a ActiveX Trojan installer. A script on the website decides which method to user according to which browser you're using.
There's a very interesting discussion here:
http://www.edbott.com/weblog/archives/000562.html :o
Edit: Point taken. Targeting alternative browsers in the sense that it attempting to install itself on these browsers as well as IE.
I wondered if Webshield would protect against this spyware particularly because I use Firefox. With IE I have many layers of protection against ActiveX installations of spyware (Spyware blaster, IE-spyad, Spybot S & D immunization).
It would be good to know that Webshield gives another layer of protection to Firefox users...
(Above not being dumb enough to click yes to such a dodgy security pop-up, of course!)
-
Web Shield checks all HTTP traffic including archived files (most common web infectors are JAR archives with payload). This is very useful for content that is not cached,but rendered directly. Standard On-Access providers of many antiviruses simply don't scan archives because they make way too high overhead. Web Shield avoids this issue and scans only the most important data that is transmitted from the web.
Such files are those JAR (JS) that i mentioned before and JPEG exploited images.
The main difference between Web Shield and Standard Shield is this:
Standard Shield example
Web -> Browser -> Standard Shield
(data is scanned when it's already passed through browser)
Standard Shield example
Web -> Web Shield -> Browser -> Standard Shield
Now do you see the differene? All data is fist checked and then passed to Browser,and if the data is cached it can be also checked by Standard Shield.
So there is much smaller chance of getting infected by some exploit if the data is scanned before it actually hits the browser itself.
Okay, I see. It's not duplicated protection but redundant protection by adding the webshield. That's good thing. Thanks!
I'm wondering if that browser security test link on your security site will sound off webshield on different browsers?
-
Well it works (web shield warning) for me using firefox, avant and IE6 SP2
-
Just out of curosity, what action does the webshield take when it sounds off on, for example, the eicar test file?
-
Just out of curosity, what action does the webshield take when it sounds off on, for example, the eicar test file?
Do you mean if an eicar virus test is detected?
For me, a popup message at the bottom of the screen. I suppose that I choose Silent Mode 8)
-
Does it block the file and no further action is needed in case the real thing ever happens?
-
Does it block the file and no further action is needed in case the real thing ever happens?
Yes, that's the way of WebShield works. Faster than the Standard Shield, safer, more comfortable.
The file won't be downloaded (or the webpage won't be displayed). Nothing will be safe in your computer, nothing will be at the cache 8)
avast rocks! ;)
-
Thanks! :)
-
Does it block the file and no further action is needed in case the real thing ever happens?
When you attempt to download the eicar.com test file it should be picked up by the web shield and it offers the option to abort the connection (just that item being downloaded, not the dial-up or broadband connection). Doing that stops it in its tracks, it doesn't get on your HDD, so there is a way to test web shield by clicking on the link that Technical gave you.
Why not check it and see what it does first hand?
-
Does it block the file and no further action is needed in case the real thing ever happens?
When you attempt to download the eicar.com test file it should be picked up by the web shield and it offers the option to abort the connection (just that item being downloaded, not the dial-up or broadband connection). Doing that stops it in its tracks, it doesn't get on your HDD, so there is a way to test web shield by clicking on the link that Technical gave you.
Why not check it and see what it does first hand?
Uh dah, I did and guess what? The Avast! notification doesn't give the action performed. ::)
-
The Avast! notification doesn't give the action performed. Roll Eyes
What action/s are you expecting? All you will be offered is abort connection (did you get that)? Since the file it isn't on your HDD yet it can't be moved to chest, deleted, etc. so those actions can't be offered.
If I click the link this is what I get, are you saying you don't see this?
-
The correct reaction should look like this (http://forum.avast.com/index.php?topic=11911.msg100756#msg100756)
-
The Avast! notification doesn't give the action performed. Roll Eyes
What action/s are you expecting? All you will be offered is abort connection (did you get that)? Since the file it isn't on your HDD yet it can't be moved to chest, deleted, etc. so those actions can't be offered.
If I click the link this is what I get, are you saying you don't see this?
No, all it gave me was the abort connection option. I wasn't sure if the infected file was cached or not. Thus, my original question.
-
Now I'm worried.
I am running Avast 4.6.623 on Win 98 SE.
According to the 'on access scanner', Web Shield is currently running, with sensitivity set to normal.
I have just managed to download the eicar test files, and save them to a folder on my C:\ drive, without any warnings / messages.
What am I doing wrong?
???
Regards
Barry
-
Extract from avast! help file Resident protection - Web Shield.
The provider works as a local proxy server. On NT-based operating systems (Windows NT/2000/XP/20003) the protection is completely transparent and it is usually not necessary to configure anything special. To enable the Web Shield on Windows 9x/ME operating systems, it is necessary to modify one setting in the Internet Options - in particular, the address and port of local proxy. So, if you want to use Web Shield on an older operating system, do the following:
You need to manually set-up the proxy settings within win98, if you haven't done that you need to.
-
No, all it gave me was the abort connection option. I wasn't sure if the infected file was cached or not. Thus, my original question.
That is the correct action 'abort connection' it stops the download so it doesn't get placed on your HDD.
-
Now I'm worried.
I am running Avast 4.6.623 on Win 98 SE.
According to the 'on access scanner', Web Shield is currently running, with sensitivity set to normal.
I have just managed to download the eicar test files, and save them to a folder on my C:\ drive, without any warnings / messages.
What am I doing wrong?
???
Regards
Barry
Make sure you browser is set for proxy server connection 127.0.0.1 port 12080
Oops, sorry David already answered the question
-
Will Webshield block Java Trojan horses which attempt to install spyware on Java enabled browsers, specifically the Trojan which attempted to install spyware on Firefox and other alternative browsers?
Apparently, several visitors to the site which caused all the fuss recently said their anti-virus programs had blocked the Trojan.
http://www.vitalsecurity.org/2005/03/firefox-spyware-infects-ie.html
I went to the offending site yesterday but the spyware seems to have been removed, so I couldn't put avast! and Webshield to the test.
(It's important to point out that this spyware requires you to click 'yes' to a very obviously dodgy pop-up dialogue box. But it would be nice to know that Webshield was providing an extra layer of security!)
-
It's important to point out that this spyware requires you to click 'yes' to a very obviously dodgy pop-up dialogue box. But it would be nice to know that Webshield was providing an extra layer of security!
You're right... thanks for posting. A lot of users are just saying: Oh, disable WebShield, it's do nothing! ;D
-
moved to new thread
-
;D
Thanks for your help everybody.
Web Shield now detects the EICAR test virus before it even gets to my PC.
Great feature.
Regards
Barry
-
I just notice my WebShield apparently isn't doing anything?????
-
You may need to manual set the proxy in your browser. 127.0.0.1 port 12080
-
Hmmmmmm.... I have win98se, IE 6, latest Avast release and I have manually configured my web browser to the proxy server/port mentioned just above in this thread.
When I attempt to access the Eicar test my browser goes to
"The Page cannot be displayed"
and I get a popup message from the Avast icon down in my toolbar stating
"http:\www.eicar.org/download/eicar.com is infected by 'EICAR Test-NOT virus!!' virus!.
I do not get the Pop-up in my screen that was posted earlier as a snapshot. Any ideas what is happening here?
-
Here's another way to test Web Shield that I'm borrowing from one of the other threads.
Go to the following page:
http://www.nod32.de/news/article.php?article_file=1096665127.txt
Scroll down the page and click on the link to the infected JPEG file. Web Shield stops it in its tracks. :)
-
This is the direct link to the JPEG exploit picture:
http://www.nod32.de/download/jpegcompoc.jpg
-
There is also one for a zip file containing the jpeg exploit picture of the download.
http://www.nod32.de/download/jpegcompoc.zip
-
There is also one for a zip file containing the jpeg exploit picture of the download.
http://www.nod32.de/download/jpegcompoc.zip
That's a perfect example of a testing the webshield. Thanks!
-
????
Try going to http://www.smileycentral.com and clicking "get smileys". This tries to load an activex control, which, on windows xp at any rate, triggers the avast web shield before windows gets to ask you whether you want to download it or not. In my tests, it appears not to work in ME/98.
Don't worry about actually loading this, because it won't be run unless you actually click "install now" (so DON'T do it, unless you want a load of advertising viruses)
Anthony
-
Now I'm worried.
I am running Avast 4.6.623 on Win 98 SE.
According to the 'on access scanner', Web Shield is currently running, with sensitivity set to normal.
I have just managed to download the eicar test files, and save them to a folder on my C:\ drive, without any warnings / messages.
What am I doing wrong?
???
Regards
Barry
Make sure you browser is set for proxy server connection 127.0.0.1 port 12080
Oops, sorry David already answered the question
good discussion here, I'm coming to the party late...
by a couple of months
a user wanting to utilize proxomitron or similar product would be out of gas if they also wanted to use web shield on an older win98 machine... is this statement correct?
I'll read the help manual but also I'm noticing that IM scanning is doing nothing - while enabled and doing IM, does this need to go through some special proxy config also...
I installed the latest version 4.6.625 or thereabouts
-
If you want to test if your shield is working, you may use the Panda EICAR testing virus:
http://www.pandasoftware.com/virus_info/work/
-
If you want to test if your shield is working, you may use the Panda EICAR testing virus:
http://www.pandasoftware.com/virus_info/work/
Thanks but my question is:
a user wanting to utilize proxomitron or similar product would be out of gas if they also wanted to use web shield on an older win98 machine... is this statement correct?
I'll read the help manual but also I'm noticing that IM scanning is doing nothing - while enabled and doing IM, does this need to go through some special proxy config also...
I think I found the answer here:
http://forum.avast.com/index.php?topic=11702.0
________________________
horbar
Jr. Member
Re: Web Shield doesn't work
« Reply #10 on: March 03, 2005, 10:20:06 AM »
....o.k... .I did the following :
Proxomitron works as proxy over Port 8080 and this Port
has to be set in: firefox/connection settings, set proxy 127.0.0.1 / port 8080.......and because Proxomitron offers the additional possibility to use a "extern proxy", where is to set :"localhost:12080"....
The setting in the firewall-rule for Webshield is : TCP/outgoing/HTTP/allowed......and so Webshield works perfectly included proxomitron
that is all....good luck
horbar
-
Thanks but my question is:
a user wanting to utilize proxomitron or similar product would be out of gas if they also wanted to use web shield on an older win98 machine... is this statement correct?
Not correct. Either setup proximotron to use webshield as upstream proxy, as suggested in your message, or setup webshield to use proximotron as its upstream proxy:
http://www.avast.com/eng/my_isp_wants_me_to_u.html
In winxp you can also setup Webshield to scan proximotron's outgoing connections:
http://www.avast.com/eng/on_my_pc_i_am_runnin.html
-
Try downloading the Eicar test virus at http://www.eicar.org/anti_virus_test_file.htm and watch avast! light up. Or anything from one of the warez/crackz type sites if you are confident.
Yep, it really works! But I think it's a rissky way...
-
This is the direct link to the JPEG exploit picture:
http://www.nod32.de/download/jpegcompoc.jpg
This one works perfeclty. ;D After aborting connection Firefox reports " The document does not contain data" or something like that.
-
Thanks but my question is:
a user wanting to utilize proxomitron or similar product would be out of gas if they also wanted to use web shield on an older win98 machine... is this statement correct?
Not correct. Either setup proximotron to use webshield as upstream proxy, as suggested in your message, or setup webshield to use proximotron as its upstream proxy:
http://www.avast.com/eng/my_isp_wants_me_to_u.html
In winxp you can also setup Webshield to scan proximotron's outgoing connections:
http://www.avast.com/eng/on_my_pc_i_am_runnin.html
Thnks for specifically answering my initial question and offering the other option with link.
I'm in process of reinstalling avast. My first install I was getting freezes on ashserv when standard shield caught eicar.com.
Will try the various options presented.
-
Thanks but my question is:
a user wanting to utilize proxomitron or similar product would be out of gas if they also wanted to use web shield on an older win98 machine... is this statement correct?
Not correct. Either setup proximotron to use webshield as upstream proxy, as suggested in your message, or setup webshield to use proximotron as its upstream proxy:
http://www.avast.com/eng/my_isp_wants_me_to_u.html
In winxp you can also setup Webshield to scan proximotron's outgoing connections:
http://www.avast.com/eng/on_my_pc_i_am_runnin.html
Lukor or anyone,
|Followup Q1| Is there any reason other than layered protection (redundancy failsafe) to keep standard shield on if you are running webshield since webshield is scanning all files and very quickly I might add.
Reason I ask is doing some speed tests I see a 55% speed increase going from 561kbps to about 870kbps.
Putting proxo on bypass and runnning with webshield but without standard shield gets me slightly over 1Mbps
_________________
It worked using the alternate method from the link you provided:
http://www.avast.com/eng/my_isp_wants_me_to_u.html
webshield is now in between my browser and proxomitron.
I set avast4.ini as follows:
UpstreamProxyHost=localhost <--- it works, is right yes?
UpstreamProxyPort=port I use for proxomitron
followed directions for terminating webshield and restarting
configured browser to use webshield as proxy on port 12080
Tested eicar.com from eicar.org and webshield caught both before they reached my laptop cache
checking speed, it does not seem to impede speed of browsing at all that I can notice at this point...
Very Coool !!!
__________________
for some reason I could not get the other method as described by horbar in my post above, to work which puts webshield at the front end, proxomitron in the middle, with browser last to receive incoming
I set my browser to use proxy 127.0.0.1 port 8080
maybe this needs to be localhost (should make no difference)
Then went into proxomitron under edit filters clicked on Proxy and added the external proxy:
localhost:12080
I even tested it and it tested ok
looked at webshield and it picked up my test
but when I ran my browser - not a peep out of webshield
I restarted laptop, just in case and ran my browser again
nothing...
|Followup Q2| If anyone can spot what I did wrong, I'd appreciate it.
Just want the option of running both ways in case one method may be faster than the other by some quirk.