Hi,

Regarding the following article from technet we setup a TMG 2010 a couple of years ago for the purpose of malware inspection.

Last week we had some pentesters to run some test on our network and to our surprise a Zeus virus could be downloaded en upload to a random selfmade server via HTTP and TMG allowed the connection.

My settings are the following:

Malware inspection is enabled

No source and destination exceptions are defined

NIS and Malware inspections are up to date.

The link to the technet article is:

https://technet.microsoft.com/en-us/library/dd182018.aspx

Could you please help me find out why TMG 2010 is not scanning for the any malware? We tried with Cryptolocker and Zeus. Virustotal ratio is min. 52/57.

Hi,

Have you checked TMG logging?

Please make the malware inspection global settings are configured correctly, including exceptions, inspections settings...

Malware Inspection at the Perimeter

Please also test with all Malware Inspection options in Inspection Setting checked.

Best Regards,

Joyce

Hi Joyce,

Thanks for you reply!

I checked you article and the malware inspection is up to date and enabled. Also there is no destination or source exception defined. The only destination exceptions are the default ones.

I also tried to download the file with all the checkbox enabled, but the zeus virus .exe file is allowed and an encrypted or corrupted zip file are denied.

When I tried with the eicar testfile it is being blocked by the url instead of the file. I can download a .exe of zipped eicar testfile and is not being blocked. I tested it also with the cryptolocker ware and thats also being allowed.

The logging says, the traffic is allowed by the http rule.

Do you have another solution?

You will also want to make sure that the individual rule has Malware scanning enabled. Having it enabled globally is not good enough. Keep in mind that the TMG Product Group stopped releasing definitions for this some time back and never made a public announcement that I could find.

TMG was also never meant to be a "total" solution. You always want to do security in layers which means you should have Antivirus on all of your client machines and servers in your environment.

You will also want to make sure that the individual rule has Malware scanning enabled. Having it enabled globally is not good enough. Keep in mind that the TMG Product Group stopped releasing definitions for this some time back and never made a public announcement that I could find.

TMG was also never meant to be a "total" solution. You always want to do security in layers which means you should have Antivirus on all of your client machines and servers in your environment.

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator 21 hours 33 minutes ago
• Marked as answer by Keith AblutonMicrosoft employee, Editor 18 hours 16 minutes ago

You will also want to make sure that the individual rule has Malware scanning enabled. Having it enabled globally is not good enough. Keep in mind that the TMG Product Group stopped releasing definitions for this some time back and never made a public announcement that I could find.

TMG was also never meant to be a "total" solution. You always want to do security in layers which means you should have Antivirus on all of your client machines and servers in your environment.

• Proposed as answer by Joyce LMicrosoft contingent staff, Moderator Monday, March 09, 2015 9:59 AM
• Marked as answer by Keith AblutonMicrosoft employee, Editor Monday, March 09, 2015 1:16 PM