Avast Free Business Cloud AntiVirus

[lwalling]

Hi Pete,

 

We'll capture this as a potential future requirement for product management to check out closer.

 

 

Most schools do use proxies for client access to the Internet. Even if it's a whitelisted site, it still has to go via the proxy because clients aren't allowed direct Internet access. On a laptop that'll spend a fair amount of time offsite a hardcoded proxy doesn't work.

 

For the Windows client you could use "Look at what Internet Explorer is doing" and for OS X, you could say "look at the system proxy settings".

 

A slightly dirtier way of doing it would be some logic along the lines of:

 

1) If a proxy is set, attempt to use it.

2) If you get a successful connection (here's an update, no update, ok status, whatever) you're done.

3) If you don't get a successful connection, try without the proxy setting.

 

WPAD support (Web Proxy Autodiscovery Protocol - Wikipedia, the free encyclopedia) would also work.

 

But your current options (below) aren't flexible enough for mobile clients that aren't using a transparent (client doesn't know there's a proxy there) proxy.

 

[ATTACH=CONFIG]29015[/ATTACH]

[ZeroHour]

Hi, thanks for the additional feedback. How long did the alert take to receive? It should not fit into the category of "eventually" I'd like to ask my support team to take a closer look at that with you to collect data can you PM me or email to walling at avast dot. com?

 

On the distinction of malware point, I materially agree, the kicker is no single company does everything just right - right? We are great endpoint security, while MBAM is probably one of the best cleanup tools I've ever used for instance.

 

Thanks

 

Hi

The mail actually was not too far behind after all, I thought the alert had came from a previous scan but it was an on access hit I think so it was about 20 minutes. How far behind approx is the unread notification email? Also does it only send 1 mail for each visit or 1 mail per alert? although some may hate 1 email for each alert I like the option to get real time email alerts so you can spot a huge trend of a threat while away from network. Because email works on everything you always have an easy way to spot things going wrong.

 

The email itself is not too bad but it would be nice if it could include a few tweaks, adding the timestamp of the alert/threat and possibly changing the subject from "Avast for Business - You have 1 outstanding notification" to something more relevant that includes say the machine name and type of alert.

 

EDIT: The alert itself was a false positive as the exe was part of the hp server management software. It detected Win64:Evo-gen [susp] from php.exe and said that it had deleted "Suspicious - Deleted" but the exe seems to remain on our servers currently. No action should result in a delete, all should go to quarantine ideally and it would be nice to have links to submit false positives or potential virus's somewhere in the console as I can't see it currently.

Edited February 6, 2015 by ZeroHour

[MattDLEA]

So is anyone using this as a solution yet?

[win]

I installed it on a test laptop last week:

 

pros - Easy to setup and use

 

cons - No scheduler to run scans

 

I think this is a major flaw for a business product as most will run a scheduled scan during off-peak hours, especially on file servers which can run for hours. When the scheduler is added i will take the plunge and migrate across, hopefully they will add it soon.

[bossman]

Testing out at the moment, have hit a problem with our Smoothwall when I run the installer exe, it returns an error which states it cannot download files:

 

14:39:05Errordldwrap[3720,3316]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://j6527783.iabs.u.avast.com/iabs/servers.def.vpx'.

 

This is obviously our Smoothwall box but for the life of me I have unfiltered the URL in the error above but just get more, am I missing something here and do I need to do something more?

 

regards

bossman

[pete]

@bossman

 

Did you set a proxy in the web console (and thus generate a modified installer) before downloading the installer?

 

If you didn't, I don't think (working from memory when I was playing with Avast) it even bothers to looks for proxy settings.

 

If you did, then did you allow the Akamai servers that the url resolves to on the SW?

[bossman]

@bossmanDid you set a proxy in the web console (and thus generate a modified installer) before downloading the installer?

 

No I didn't as I only downloaded the light installer version, will try again,

 

If you didn't, I don't think (working from memory when I was playing with Avast) it even bothers to looks for proxy settings.

 

Well that could be a help, thanks

 

If you did, then did you allow the Akamai servers that the url resolves to on the SW?

 

No I haven't as I am just testing at the moment, would you happen to have the URL or IPs of those servers please?

[bossman]

@pete

 

Downloaded the full silent installer which has installed on the test workstation but it has been 10 mins plus and no sign of it in the console could this be Smoothwall blocking the Avast admin servers?

 

I have configured the proxy settings in the console but without devices I cannot activate and set the default settings for the AV a catch 22 atm

[pete]

Your error message from the other day:

14:39:05Errordldwrap[3720,3316]GetFileWithRetry: An error 41222 (0x0000A106) [Host unreachable] has occured when downloading a file from 'http://j6527783.iabs.u.avast.com/iabs/servers.def.vpx'

 

Has the host: j6527783.labs.u.avast.com

 

That resolves (nslookup/dig) to:

 

pete@memory:~$ dig j6527783.iabs.u.avast.com

;; ANSWER SECTION:
j6527783.iabs.u.avast.com. 600	IN	CNAME	avast.com.edgesuite.net.
avast.com.edgesuite.net. 18987	IN	CNAME	a1639.g1.akamai.net.
a1639.g1.akamai.net.	11	IN	A	2.20.183.178
a1639.g1.akamai.net.	11	IN	A	2.20.183.168

 

So I'd check that *.labs.u.avast.com, avast.com.edgesuite.net and a1639.g1.akamai.net are OK and I'd probably remove the auth requirement (at least in testing) on SW for those domains. The last one could be a bit iffy, depending on what else is hosted there, but generally speaking if it's dodgy the end-user isn't going to be hitting akamai.net directly, but the URL using the service.

[SpaceInvader83]

I've had similar issues , aswell as the client proxy settings there is a couple of cfg files that also need editing, sadly this is a manual task at the moment so is preventing me from rolling it out:

Be sure to disable the self defense on the client which can be found in the troubleshooting on the client.

Program Files - bcc.cfg under C:\Program Files\AVAST Software\Avast\conf and it's also under Program Data - C:\ProgramData\AVAST Software\Avast\var

 

Append the following in both cfg files:

use_proxy=0 - off / 1 - on

proxy_port=8000

proxy_ip=10.10.10.10 etc.

proxy_auth=0 - NONE, 1 - BASIC , 2- NTLM

proxy_user=username:password

[bossman]

@pete @spr

 

All sorted, created a policy in Smoothwall and whitelisted the url also outgoing rule for IP address and all is well

 

Thank you all for your help

 

3 workstations on test atm all looking good

[nicholab]

Can this be used for charities?

[MrKJLS]

Can this be used for charities?

 

Yep, you can use it anywhere.

[SpaceInvader83]

@bossman Just out of curiosity what IP did you put as an outgoing rule on smoothie?

[bossman]

@spr

 

Guardian>Exceptions>destination exceptions

 

IP addess 5.45.58.139

 

Created category avast.com added to policy and whitelisted

[SpaceInvader83]

How are people finding this? Would you recommend moving to it completely?

[bossman]

@spr

 

Totally! Its great and we are nearly 100% clients and servers now just a few more clients to rollout (approx 70)

 

The interface has been changed and looks really neat although I feel it is a work in progress it suits our needs and it is free!

 

Highly recommend

[pete]

Is the proxy detection any more flexible these days?

[MattDLEA]

@bossman I'm guessing this is doable.

 

Is it possible to remove Eset from some computers and install Avast on them, while running Eset on the remainder as a trial, thats not going to break things?

 

Also how does the updates work? Does each client have to connect to the internet, download the update then install or is it like Eset ( should work if set up correctly ) that it down loads somewhere on the server and then gets deployed locally ( so just using local bandwidth?)

[bossman]

@MattDLEA

 

Yes no problem as long as you don't have both on at the same time you should be fine, make sure you use the ESET removal tool as just uninstalling doesn't get rid of all of it as Kaspersky didn't for us.

 

Have fun

[tj2419]

Would people recommend this as a replacement for RM Virus Protect for a secondary school?

 

Just looking into it now. Anyone run into problems with it?

 

Like everyone my budget is getting smaller and smaller so this might save us some money.

[AJWhite1970]

Got this on 5 test PC's and so far so good. All the settings are populating to the PC's and the integration with Outlook is working. The only thing I missed was one of the proxy exceptions is *.iabs.u.avast.com (an i) not *.labs.u.avast.com as I first read it!!!

 

The only irritant thus far appears to be its willingness to prompt the user to reboot after an update.

 

I can't find where to disable this in the console or is this something I need to change manually in the ini files in C:\ProgramData\AVAST Software\Avast?

 

Can anyone whose using this point me to the blindingly obvious place I've missed?

 

Cheers

Andrew

[tj2419]

Hi AJWhite1970,

 

Try this:

 

Network > Settings > The Policy you are using

Click advanced at the top right

General Settings tab

Tick Silent mode

 

Does that stop it?

It says it should prevent notifications etc

 

Are you looking to replace another product with it?

[win]

So far the only way to run a scheduled scan is to set it up locally on each machine. Not a problem on small networks but could be a problem for larger ones. Their support team said this feature will be added in the future, but they can't confirm if it will override the local scheduled scan settings.

[pete]

Can you export the scan settings (config file? registry?) once configured on one computer?

 

Pushing out a config file with GPP or $whatever isn't particularly difficult.