Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Fract504 on December 03, 2004, 05:56:57 PM

Title: Realtime scan of Firefox Cache
Post by: Fract504 on December 03, 2004, 05:56:57 PM
Hello,

how can I tell Avast to do enable a realtime scan for files without any extension (the cache files of firefox do not have any extension)?
I don't want to set avast to scan all files regardless of the extension, but just the default filetypes it recognizes plus the files without any extension.

I tried entering  , , in the additional list and I tried also a single dot in this list, but it does not do what I want.

Any help please?
Title: Re:Real Time Scan of Firefox Cache
Post by: Lisandro on December 03, 2004, 07:13:29 PM
How can I tell Avast to do enable a realtime scan for files without any extention (the cache files of firefox do not have any extention)?

I think you can't... follow this way i.e., add the * on the read/create/modify option of the Standard Shield. This provider will read the file as 'plain text' by this way.

You should ask for the 'High' sensitivity option.
Title: Re:Real Time Scan of Firefox Cache
Post by: DavidR on December 03, 2004, 07:21:26 PM
Firefox's extensionless cache, I believe is to make it less vulnerable to attack.

Unfortunately, this makes it difficult to scan the files efficiently, you either have to scan all created/modified files as I don't believe there is a way to include files without a extensions in the additional extensions window.

I don't think there is a way to define this with wildcards or otherwise.
Title: Re:Real Time Scan of Firefox Cache
Post by: Fract504 on December 03, 2004, 07:40:08 PM
Hi folks,

thanks for your anwers. I think I will set the realtime scanner to scan all files created or changed. Maybe avast should include an option to scan files without extension in the next release.
Title: Re:Real Time Scan of Firefox Cache
Post by: Lisandro on December 03, 2004, 08:11:49 PM
Maybe avast should include an option to scan files without extention in the next release.

It was discussed a lot in the past... It's not just an option... Huge amount of hours of programming...  :P
Title: Re:Real Time Scan of Firefox Cache
Post by: Fract504 on December 03, 2004, 08:25:54 PM
Technical,

are you kidding? It cannot be that much work to test a filename for an empty extension. Even our "rival" Antivir scans extensionless files by default...

Still i can't decide if I should put the Standard Shield to "high" or if I can live with the unscanned firefox cache...

I don't know how dangerous it is not to scan the cache...
Title: Re:Real Time Scan of Firefox Cache
Post by: rdsu on December 03, 2004, 11:57:34 PM
Technical,

are you kidding? It cannot be that much work to test a filename for an empty extension. Even our "rival" Antivir scans extensionless files by default...

I agree with you...
Title: Re:Realtime scan of Firefox Cache
Post by: DavidR on December 04, 2004, 12:27:18 AM
I agree with Technical, ignorance is bliss. This will take some programming.

How do you go about selecting the correct scanning tool/packer for a file without a file extension, you have to identify the file type before you can check it for infection.

Or you have to do a simple text file scan (as Technical said) which is unlikely to be effective and miss infected files in packed/compressed form.

Yes some other programs do it, but how effective is it what type of scan are they doing. Just because they do it doesn't necessarily make it better.

Firefox has only got to 1.0 official release, you are surely not saying that time should be spent trying to follow beta developments of firefox when the the final version could be vastly different.

That is time and money wasted (programmers have to be paid), it stops regular development of avast, offered free to you and I for non business use.
Title: Re:Realtime scan of Firefox Cache
Post by: rdsu on December 04, 2004, 01:08:05 AM
I agree with Technical, ignorance is bliss. This will take some programming.

Try to respect the others opinions...
Title: Re:Realtime scan of Firefox Cache
Post by: inthewildteam on December 04, 2004, 01:16:07 AM
@ Fract504,

if you have a fast connection, just set the cache to use 0kb from the tools/options/privacy in Firefox.  Only reason I can see for cacheing any net session would be for off-line browsing or if you use a dial-up connection to speed up page rendering.

I use F/fox here in the U.K. with the above setting on a cable connection with no hit on page load speeds.
Title: Re:Realtime scan of Firefox Cache
Post by: Fract504 on December 04, 2004, 11:28:14 AM
Hi inthewildteam,

I also thought about this possibility, because I am on a 2MBit DSL-Connection flatrate...

Maybe files without any extension should be scanned as html-type files, then at least we would get the files scanned that mostly enter our systems without any control: The Web-Pages. If the extensionless files of the firefox are not scanned, a vbscript virus can enter the system easily.

I think firefox does matter a lot, so some coordinated look into this matter should be done.

Of course I can set my realtime settings to high, but I don't see any sense in scanning .txt or .png files when they are written to the disk. Also a little more cpu is also consumed.

Scanning extensionless files as html/php/xml-type would definately be a step in the right direction. At least better than not scanning them at all ;)
Title: Re:Realtime scan of Firefox Cache
Post by: Eddy on December 04, 2004, 11:35:30 AM
Scanning files without extension is already possible.
Just set the standard shield provider to scan "created/modified files" and select "all"
Title: Re:Realtime scan of Firefox Cache
Post by: Fract504 on December 04, 2004, 11:39:50 AM
Hi Eddy,

please read the complete thread. You will see that this possibility has been known to me from the very beginning and thats not the point anymore.

Another point with firefox and scanning is the memory cache of firefox. Who is responisible for scanning that kind of storage. I think currently no product scans this area. Just something to think about.
Title: Re:Real Time Scan of Firefox Cache
Post by: Lisandro on December 04, 2004, 12:14:32 PM
Technical, are you kidding?

Fract, I understand you and I hope VaMPiRiC_CRoW try to respect my opinion too.
I'm just saying you're asking and talking about things that were discussed a lot in the past. Please, don't come here just to ask for. Try to contribute sometimes. I'm a little upset  :(

Did you read this:
http://forum.avast.com/index.php?board=2;action=display;threadid=998
http://forum.avast.com/index.php?board=2;action=display;threadid=1096
http://forum.avast.com/index.php?board=2;action=display;threadid=5668
http://forum.avast.com/index.php?board=1;action=display;threadid=5740
http://forum.avast.com/index.php?board=2;action=display;threadid=57
http://forum.avast.com/index.php?board=2;action=display;threadid=5714
http://forum.avast.com/index.php?board=2;action=display;threadid=6141
http://forum.avast.com/index.php?board=2;action=display;threadid=7503
http://forum.avast.com/index.php?board=9;action=display;threadid=7650

I'm not kidding. I just respect Alwil team work. I don't come here to blame!

Read Igor's post here: http://forum.avast.com/index.php?board=2;action=display;threadid=6429;start=msg49871#msg49871

Test if a ? works...
Title: Re:Realtime scan of Firefox Cache
Post by: Fract504 on December 04, 2004, 01:27:05 PM
Hi technical,

Thank you very much for posting these links. I didn't just searched good enough.

And sorry for reporting something "negative" of avast which can be improved. Seems that some people here want to hear: Avast is perfect. Nothing has to be changed.

I don't agree with that kind of fanatism.

And I'm not coming here to ask for. I am simply reporting with open mind. I am not forcing anybody to implement any improvements. At least the avast Home version is free and I'm totally happy that we got more then we could expect for that "price".

Update: Btw: I tried adding ? to the extension list and that works! So thanks very much for that info!!
Adding ? just scans files without any extension. Technical: Friendship again?
Title: Re:Realtime scan of Firefox Cache
Post by: Lisandro on December 04, 2004, 02:11:00 PM
Adding ? just scans files without any extension. Technical: Friendship again?

Thanks to Igor  ;)
Title: Re:Realtime scan of Firefox Cache
Post by: Fract504 on December 04, 2004, 02:22:35 PM
OK, thanks to you both. Enough talk about this issue...

Adding ? makes me happy!
Unfortunately I don't know how to test if a virus is detected on this extensionless files... Is there something like an eicar test virus as an html-page. So an infected page which does not do any actual harm?

Title: Re:Realtime scan of Firefox Cache
Post by: techie101 on December 04, 2004, 03:13:53 PM
Fract54, Vampiric_Crow

I can understand your question and can only add these few comments.  If it is possible to come up with a way to properly check "extention-less" files, then I am sure that the Avast Team will attempt to do so.

It is a very difficult task when most signature databases are designed to identify file extentions known to be used as virus carriers.

Eddy mentioned a method that is sort of a workaround, but at best is all we have.

As for the "tension" that seems to have developed here....
Opinions are respected and so are your's as long as noone makes a direct attack on another.

Keep in mind that the present state of Avast is the result of very hard work on the part of the developers, and many many suggestions by users such as yourselfs.

We are sometimes fanatical about Avast.  It is a very good product and freeware but it is not perfect and bugs do develop.  I realize that is so, but they are taken care of as soon as time allows.

Remember that the Avast Team is small but still keeps up the VPS files, works on new version releases and betas, as well as research new and innovative ways to safeguard your system.  In addition, they respond to support email, as well as work on this forum with the rest of us.  They may not "say" much at times, but they "hear" your suggestions.

Thank you for your opinion, and I hope we can keep the tone of this thread "cool"

Techie

Title: Re:Realtime scan of Firefox Cache
Post by: Lisandro on December 04, 2004, 03:41:48 PM
I don't agree with that kind of fanatism.
Technical: Friendship again?

I try to be friend of everyone here... sometimes, my fault, I could't. I think it's not your case.
I just complain when Alwil said they will have to work hard, they're trying to solve something, they're trying to do their best and, we, the users, stay here complaining, blaming, asking a million times for features... As everybody can see, it was discussed a lot in the past.

Fract, it's not you, again, it's just when I read comments about avast in this forum but specially in other ones and they don't know what they're asking, talking about, etc.
We must respect the company that releases avast for free and the differences between Home version and Professional one (although, in this case of extensionless, the Professional version won't help).

Just a bad day for me... Can everybody understand, I suppose... We all have bad days  :P
Title: Re:Realtime scan of Firefox Cache
Post by: Fract504 on December 04, 2004, 03:53:34 PM
no problem technical.

As for the scanning of extensionless files:
I actually found a file called jpegcompoc.zip  here:
http://www.gulftech.org/?node=downloads

It is a picture with the know jpeg exploit, but besides crashing an unpateched IE it does not do any harm.

Avast detects this "virus" when the picture is renamed to a file without extension. So it would also be correctly scanned and detected in the firefox cache. It is detected as "MS04-028 JPEG Exploit"

So besides the ? extension, I will also add jp*,jif,jfif to the scanned extensions list. Or maybe just j*
Title: Re:Real Time Scan of Firefox Cache
Post by: rdsu on December 05, 2004, 12:33:04 PM
Technical, are you kidding?

Fract, I understand you and I hope VaMPiRiC_CRoW try to respect my opinion too.
I'm just saying you're asking and talking about things that were discussed a lot in the past. Please, don't come here just to ask for. Try to contribute sometimes. I'm a little upset  :(

Did you read this:
http://forum.avast.com/index.php?board=2;action=display;threadid=998
http://forum.avast.com/index.php?board=2;action=display;threadid=1096
http://forum.avast.com/index.php?board=2;action=display;threadid=5668
http://forum.avast.com/index.php?board=1;action=display;threadid=5740
http://forum.avast.com/index.php?board=2;action=display;threadid=57
http://forum.avast.com/index.php?board=2;action=display;threadid=5714
http://forum.avast.com/index.php?board=2;action=display;threadid=6141
http://forum.avast.com/index.php?board=2;action=display;threadid=7503
http://forum.avast.com/index.php?board=9;action=display;threadid=7650

I'm not kidding. I just respect Alwil team work. I don't come here to blame!

Read Igor's post here: http://forum.avast.com/index.php?board=2;action=display;threadid=6429;start=msg49871#msg49871

Test if a ? works...

I don't respect your opinion!?

I just said that I have another, and didn't called ignorante to nobody!
Title: Re:Realtime scan of Firefox Cache
Post by: igor on December 06, 2004, 09:43:47 AM
Adding ? just scans files without any extension.

Actually, it scans files without any extension and files with one-letter extension. I hope it's not a big problem though...
Title: Re:Realtime scan of Firefox Cache
Post by: Fract504 on December 06, 2004, 09:15:19 PM

Actually, it scans files without any extension and files with one-letter extension. I hope it's not a big problem though...


No thats really no problem. As told I am happy with the solution!