How to Restrict Transfer of packed executable files like UPX, FSG, PKLite32, Petite, and

Description

Restrict Transfer of packed executable files (UPX, FSG, etc.) - option in the Security Services | Gateway Antivirus disables the transfer of packed executable files.

Packers are utilities which compress and sometimes encrypt executables. Although there are legitimate applications for these, they are also sometimes used with the intent of obfuscation, so as to make the executables less detectable by anti-virus applications. The packer adds a header that expands the file in memory, and then executes that file. SonicWall Gateway Anti-Virus currently recognizes the most common packed formats: UPX, FSG, PKLite32, Petite, and ASPack. additional formats are dynamically added along with SonicWall GAV signature updates.

Resolution

Step 1: Login to the SonicWall Management Interface.
Step 2: Navigate to Security Services | Gateway Antivirus.
Step 3: Ensure the Enable Gateway Antivirus option is checked.
Step 4: For each protocol you can restrict the transfer of files with specific attributes by clicking on the Settings button under the protocol
Step 5: In the pop up window, enable the Restrict Transfer of packed executable files (UPX, FSG, etc.) option.


By default, SonicWall GAV inspects all inbound HTTP, FTP, IMAP, SMTP and POP3 traffic. Generic TCP Stream can optionally be enabled to inspect all other TCP based traffic, such as non-standard ports of operation for SMTP and POP3, and IM and P2P protocols.

Image

Step 6: Click OK and Accept button to save the settings.

Related Articles

  • How to block ICMP (Ping ) using Application control
    Read More
  • SonicWall GEN8 TZ and NSa Firewalls FAQ
    Read More
  • How to configure Link Aggregation
    Read More
not finding your answers?