How to test?

[Mooihoek]

How to validate virus blocker lite is actually working? When I download EICAR test files it seems to let them through although Bitdefender is also doing its job. I can see some entries in the Scanned Web Event report but not all.

I want to remove Bitdefender and use Windows Defender across my Windows devices.

Does the Virus Blocker give me anything additional?

Any thoughts?

[sky-knight]

Virus Blocker Lite can only scan unencrypted transport protocols. So FTP and HTTP.

Virus Blocker has a few more tools that let it peek into https, but both honestly don't do well without SSL Inspector deployed.

I've often wondered why everyone gets so worked up on these two modules, why do you care? Web Filter's malware category is vastly more effective at virus control, along with Threat Prevention those are your two modules to be used to contain the spread of malware. Virus Blocker and Virus Blocker Lite have their value, but they duplicate what your endpoint AV should be doing. If you're thinking you want an additional vendor check, I suggest you use the endpoint protection that is meant for that.

Or you can do that SSL man in the middle thing that defeats the purpose of SSL and causes endless support issues. (SSL Inspector)

The world has moved on from this sort of scanning, use the more modern tools!

[BryanC1968]

sky-knight...

What are the more modern tools you are referring too..? And if the SSL Inspector and Virus Blocker Apps are so ineffective, then why are they still being included with Untangle..? What is the purpose of these apps if they don't work..?

Just asking...

[sky-knight]

sky-knight...

What are the more modern tools you are referring too..? And if the SSL Inspector and Virus Blocker Apps are so ineffective, then why are they still being included with Untangle..? What is the purpose of these apps if they don't work..?

Just asking...

They do work, they just don't work as people expect them to. They have value, but not in the application you're after.

The tools you use now are Web Filter, and Threat Prevention. They're very good at preventing access to malware laden content, and preventing that malware from accessing other things in the wild. They do this with their default configurations too, so you don't have to tell them to do it. Though I suppose you could tell them not to... but that would be silly.