topic ASA - CSC - Problems with EXE Files in Network Security

ASA - CSC - Problems with EXE Files

nuria.andres — Mon, 11 Mar 2019 09:11:54 GMT

Hi,

I have problems with EXE Files, when I have enabled the "WEB Scanning". I have disabled the option "File Blocking".

When I try to download a EXE File, I get "error by timeout".

Can Anybody help me?.

Thank you very much.

Best Regards.

Nuria

Re: ASA - CSC - Problems with EXE Files

ryan_holland — Fri, 22 Dec 2006 23:00:53 GMT

Nuria,

How large are the files you are attempting to download? Have you enabled the large file scanning option under HTTP Scanning?

This allows the CSC card to send small amounts of data to the endpoint, while it downloads the file to be scanned and will prevent client timeout errors.

Re: ASA - CSC - Problems with EXE Files

nuria.andres — Tue, 26 Dec 2006 07:48:45 GMT

Ok, I have enabled the option "Enable deferred scanning for files larger than 2 MB", and now, it seems, that I can download EXE files.

On the other hand, I have another two problems, with the CSC:

- I get nothing when I select Logs->Query. I mean, the CSC is stopping virus and spyware, but the reports generated when it selected the option Logs->Query, it doesn?t show anything.

- When I execute th EICAR TEST (www.eicar.org), the CSC doesn?t stop all files. is this normal?.

Thank you very much

Best Regards

Nuria

Re: ASA - CSC - Problems with EXE Files

ryan_holland — Wed, 27 Dec 2006 19:39:57 GMT

The Logs->Query should show event, make sure you have selected the correct protocol to show logs for. If you require more detailed reporting the Trend Micro Control Manager can provide more detailed centralized reporting for the CSC and other Trend products.

As for the EICAR test file, which ones were not blocked? Anything that was downloaded unencrypted will be blocked. Its possible you were downloading the file via HTTPS or an encrypted ZIP file.

Thanks

Ryan

Re: ASA - CSC - Problems with EXE Files

nuria.andres — Thu, 28 Dec 2006 13:56:50 GMT

It doesn?t block the two first tests (eicar.com y eicar.com.txt). The another 2 tests (eicar_com.zip and eicarcom2.zip) are Ok. The CSC stop them.

And I have execute these tests, via HTTP.

Thank you very much.

Best Regards.

Nuria

Re: ASA - CSC - Problems with EXE Files

ryan_holland — Fri, 29 Dec 2006 09:13:41 GMT

I've not been able to duplicate this, what are your scan settings?

thanks

Ryan

Re: ASA - CSC - Problems with EXE Files

nuria.andres — Mon, 01 Jan 2007 22:12:33 GMT

Hi,

In the attachment, you can see the CSC version and the web scanning properties.

do I have to activate anything else?.

Happy New Year.

Thank you very much

Best Regards

Nuria

Re: ASA - CSC - Problems with EXE Files

Florian Pressler — Mon, 20 Sep 2010 12:37:38 GMT

Hi,

I have exactly the same problem. The SCS-SSM detects the EICAR-Testvirus when being zipped, but lets it through when it is unzipped.

I'm sure that the configuration on the ASA is correct, HTTP is generally allowed and forwarded to the module.

Does anybody have an idea?

Thanks,

Florian