+ Post New Thread
Results 1 to 5 of 5
Internet Related/Filtering/Firewall Thread, What do you do? IP Address Browsing, Viruses, BBC iPlayer and S4C Clic in Technical; Hi, I would like to find out how other schools are tackling the following problem. We have been blocking IP ...
  1. #1

    Join Date
    Jan 2011
    Posts
    26
    Thank Post
    2
    Thanked 3 Times in 1 Post
    Rep Power
    8

    Question What do you do? IP Address Browsing, Viruses, BBC iPlayer and S4C Clic

    Hi,

    I would like to find out how other schools are tackling the following problem.

    We have been blocking IP address browsing for a while now due to having a large number of infections coming from websites using IP addresses as opposed to URL's. All of these websites seem to impersonate "My Computer" for Windows XP and make you think that your PC is infected and usually install an infection which poses as an antivirus. We are using Bloxx Web Filter which has an antivirus built in (I can't remember which one it uses) and Symantec Endpoint Protection and neither of them were catching the infections. I spoke to Symantec on a few occasions and their answer is always "download this tool and it will remove the infection for you". But if that's the case, what's the point in having Symantec Endpoint Protection if it doesn't stop infections and instead I have to download a tool and manually remove the infection every 5 minutes? I've also spoken to Bloxx and they just ask me for the address so they can add it to their URL database. But there are so many of them and it wouldn't surprise me if they are continuously changing their addresses, so this isn't going to help much.

    The problem we have now is that websites such as BBC iPlayer and S4C Clic stream all of their media from IP addresses. So staff are now understandably unhappy because they can't access videos they want to use in their lessons. I agree that they should be able to use these two websites in particular (maybe some others too). I thought of simply unblocking the specific IP addresses used by these two websites, but first of all I don't have a list of them (and neither do Bloxx) and second, even if I can get hold of a list I don't know if or how often these addresses are going to change. This isn't going to be any good if teachers are planning their lessons around these videos only to find that on the day the IP's have changed and the videos are blocked again.

    So my questions are:

    1) Is anybody else having/had the problem with these viruses coming from IP based websites? (I have seen similar websites using URL's but the majority seem to be IP addresses.)
    - a) Do you have a solution for this problem other than blocking IP addresses?

    2) Is there anybody blocking IP addresses with a solution for allowing BBC iPlayer and S4C Clic?

    3) How many schools are blocking IP addresses? Are we part of a small group or do most schools do this?

    4) Does anybody have any other tips or advice?

    Thanks in advance,

    Daniel

  2. #2

    3s-gtech's Avatar
    Join Date
    Mar 2009
    Location
    Wales
    Posts
    2,775
    Thank Post
    146
    Thanked 564 Times in 508 Posts
    Rep Power
    153
    Our LEA use Smoothwall for filtering, which the schools connect to as their proxy server. That blocks websites with only an IP address, but iPlayer etc get through no problems.

  3. #3

    GrumbleDook's Avatar
    Join Date
    Jul 2005
    Location
    Gosport, Hampshire
    Posts
    9,935
    Thank Post
    1,341
    Thanked 1,784 Times in 1,107 Posts
    Blog Entries
    19
    Rep Power
    595
    Is your desktop AV not picking things up? What are the details of what the infections are?

  4. #4

    Join Date
    Jan 2011
    Posts
    26
    Thank Post
    2
    Thanked 3 Times in 1 Post
    Rep Power
    8
    It's been a couple of months if not longer since we blocked IP addresses to stop this. Unfortunately I can't remember the names of the fake antivirus infections; there were several different ones. Our desktop AV (Symantec Endpoint Protection) was not picking them up at first. Each time I removed an infection using the tools provided by Symantec there would be an update with a virus definition for it a couple of days later, but then we would get infected with a different fake antivirus. At least with a different name and slightly different appearance, not 100% sure that the infection itself was different. Our AV was picking up other things though, it wasn't completely broken.

    Some, if not the majority of the websites seemed to appear when a user hovered over or clicked on an image from Google Images. It wouldn't happen with every image, just random ones. I searched the web and found other people reporting the same problem. I also emailed Google but never received a reply. (I'm not trying to point fingers at Google themselves) Since blocking IP addresses we have had very little problems with infections.

  5. #5

    sonofsanta's Avatar
    Join Date
    Dec 2009
    Location
    Lincolnshire, UK
    Posts
    4,954
    Thank Post
    862
    Thanked 1,444 Times in 991 Posts
    Blog Entries
    47
    Rep Power
    617
    With regards to the poisioned Google Image results, that were a big problem globally last year, most of them get stopped by blocking ur.php and ru.php with a regex expression. It works on our Smoothwall G3 here; don't know if Bloxx can do similar.

  6. Thanks to sonofsanta from:

    stanwell (2nd February 2012)

SHARE:
+ Post New Thread

Similar Threads

  1. What Do You Drive?
    By in forum General Chat
    Replies: 148
    Last Post: 26th January 2012, 10:06 AM
  2. Software company needs an IP address - what do I give them?!
    By sidewinder in forum Wireless Networks
    Replies: 17
    Last Post: 23rd July 2007, 10:32 PM
  3. What do you reckon to this job ??
    By mac_shinobi in forum General Chat
    Replies: 7
    Last Post: 28th January 2006, 04:11 PM
  4. Old hardware - what do you do with it?
    By tarquel in forum Hardware
    Replies: 24
    Last Post: 11th November 2005, 02:35 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •