topic Re: Url filtering [Malware/Adware] in Firewall and Security Management

Url filtering [Malware/Adware]

humt — Fri, 08 Nov 2019 05:13:20 GMT

I am facing the big issue of virus(Malware/Adware]. And i am fedup now. I have format my system 3 times and 2times reset the firewall but the virus did not gone yet. Firewall not able to block yet. Even antivirus did not able to clean it yet. It is coming again and again. And i am not sure , how did it enter into system.

Behavior-

1) Internet auto disconnecting again and again.

2) Changing the settings of firewall which i feel. It stop accessing localhost IP address.

3) I feel when i synchronize the data with google for backup. Virus is entering into the system. Is it possible virus is entering via Google. Just take chrome data only via synchronize.

These are the below website which open sometime with different websites

arcaptarts[.]site

allashark[.]site

areantaid[.]site

I have block these website manaully. But it is useless. Almost coming new website in next 2-4days.

Re: Url filtering [Malware/Adware]

PhoneBoy — Fri, 08 Nov 2019 20:54:49 GMT

It could very well be something in the Chrome data (specifically an extension) that is causing this to happen.

Re: Url filtering [Malware/Adware]

FedericoMeiners — Sat, 09 Nov 2019 00:52:55 GMT

First of all ensure that your URL Filtering policies is blocking all "bad" categories such as Adware, high risk, critical, risk, malware, among others. This is not a silver bullet since URLs should be categorized as such. You can create a rule to drop all uncategorized traffic and set URL Filtering to do a fail close approach to the packets but most of the time this is cumbersome for end users.

Second: Your Firewall antivirus engine will not do anything if malware is being downloaded via HTTPS, you will need to configure Outbound HTTPS Inspection on your firewall.

Last, put that host in quarantine and perform a proper malware removal, it's not really a good practice to let your firewall handle all the incident handling, specially if the host is already compromise.

Hope it helps

Re: Url filtering [Malware/Adware]

humt — Thu, 14 Nov 2019 15:32:44 GMT

As I see. CP now blocks the url but still I am not aware how this adware/malware is coming. There is no extension, notification or external software except antivirus installed in system.I have format the system and not working. Until I don't know how it enter into system. I am scared to open any website. If some one knows. Please let me know. Antivirus are still researching. No antivirus is able to detect it. I have already try Malwarebytes,Kaspersky, quickheal,bitdefender,Norton. I have report to Kaspersky for this issue. And waiting for update.