HTTP Anti-Virus Proxy
http://havp.hege.li/forum/

virus scanner information on virus found block page
http://havp.hege.li/forum/viewtopic.php?f=4&t=74
Page 1 of 1

Author:  Guest [ 16 Apr 2006 23:43 ]
Post subject:  virus scanner information on virus found block page

on the "virus found" page of HAVP it would be great to have an
information of the used scanner, for example i use clamd, fprot and avg
and for the eicar virus i get:

Quote:
Access to the page has been denied

because the following virus was detected

Eicar-Test-Signature,
EICAR_Test,
EICAR_Test_File


and i guess the viruses are listed in the same order as in the config file,
but if one scanner finds the virus and the other doesn't then the order of the scanners will not allow someone to know which scanner actually found the virus

would it be possible to have an addtional field with the scanner information
so that the page could look like this:

Quote:
Access to the page has been denied

because the following virus was detected

Clamd: Eicar-Test-Signature,
AVG: EICAR_Test,
F-Prot: EICAR_Test_File

Author:  madlener [ 16 Apr 2006 23:43 ]
Post subject:  login

sorry, i forgto to login before posting

Author:  hege [ 17 Apr 2006 11:38 ]
Post subject: 

Yeah I guess this can be added to next version..

Cheers,
Henrik

Author:  Guest [ 17 Apr 2006 13:26 ]
Post subject: 

cool, thankx !

(its a good possibility to see which scanners have the best detection)

:-)

Author:  Guest [ 24 Apr 2006 00:48 ]
Post subject: 

Make it an option please, for those of us who don't want people to know what scanners are used ;)

Any chance of havp being able to redirect (sending information via query strings or another method) to a url?

I use a server side script to log everything and am using a meta refresh to parse havp information. Sadly all i get is the virus name, not the user, ip, pagge visited etc.

Squidguard could be a good template for noting the information thats most useful.

Thanks a million!

Author:  hege [ 24 Apr 2006 08:38 ]
Post subject: 

Anonymous wrote:
Make it an option please, for those of us who don't want people to know what scanners are used ;)


Yeah I thought of that, but people can easily identify scanner from the virus name itself too.. maybe we should not show names then either? In that case, that modify virus.html and remove the <!--message--> thing.

Quote:
Any chance of havp being able to redirect (sending information via query strings or another method) to a url?

I use a server side script to log everything and am using a meta refresh to parse havp information. Sadly all i get is the virus name, not the user, ip, pagge visited etc.

Squidguard could be a good template for noting the information thats most useful.

Thanks a million!


Is there some standard URL parameters that it should have? Let me know and I'll maybe have a look..

Cheers,
Henrik

Page 1 of 1 All times are UTC + 2 hours [ DST ]
Powered by phpBB® Forum Software © phpBB Group
https://www.phpbb.com/