Rarlab blocked by Firewall

[snadge]

Iam using the latest public version 7.0.317799.4142 and both pages (download page that isnt blocked) are the same if its rarlabs or rarlab… its just rarlab TLD thats blocked

as above when I open Winrar and choose “open home page” it opens at the blocked one…

Iam going to ask rarlabs

[SantiBailors]

When I look at the Website filtering logs of CIS it tells me it is viewed as a malware site.

I can’t figure out how to get to the filtering logs (or any log for that matter). Is it possible through the GUI at all ? Or should I go to some folder in the file system ?

[captainsticks]

Hi SantiBailors,
View CIS Logs-Comodo Help
Website Filtering Logs-Comodo Help

Kind regards.

[snadge]

I have this from Rarlabs

> Hi

My comodo firewall is blocking your sister page rarlab.com saying it
is malware, I have approached comodo on their forums about it but
don’t want to seem to change things and only advise to add it too
whitelist and that rarlabs.com is the real site, think they may be worried rarlab.com is a fake?
Yet their firewall still allows us onto the rarlab.com/downloads

Hello,

it is false alarm.

Please update your virus/malware signature and if it doesn’t help, please inform the support of your anti-virus/anti-malware software about this problem.

Best regards,
Gerhard Lühning at WinRAR-Support

win.rar GmbH
Marienstr. 12
10117 Berlin
Germany

www.win-rar.com (website)
support[at]win-rar.com (e-mail)

---

win.rar GmbH Berlin | HR B-Nr. 109885 B
Management: Öncül Kaya, Burak Canboy | Amtsgericht Charlottenburg
*****************************************************************************

so looks like comodo need to whitelist it?

[SantiBailors]

Thanks captainsticks, I found the logs.

Rookie question, is this kind of blocks a result of Comodo scanning some files found in the webpage and detecting infections / malware code in them, or is the blocking based on the webpage address alone ?

[captainsticks]

Hi SantiBailors,

@SantiBailors post:13

…Rookie question, is this kind of blocks a result of Comodo scanning some files found in the webpage and detecting infections / malware code in them, or is the blocking based on the webpage address alone ?

@wasgij6 post:3

currently the url filter uses signature (lists) to block sites. it doesnt have any heuristics or anything like that that i know of. CIS updates the url database like signature updates. im currently downloading the installer so idk if there are url filter signatures yet. go to the about screen and check the url filter number. last time i checked it was at 0

Kind regards.

[SantiBailors]

Got it, thanks.
So I’m wondering, did Comodo add rarlab.com to the malware list by mistake, or did they have reasons to do so ? This would be a useful thing to know before manually adding that URL to the filtering exclusions.

[captainsticks]

@SantiBailors post:15

Got it, thanks.
So I’m wondering, did Comodo add rarlab.com to the malware list by mistake, or did they have reasons to do so ? This would be a useful thing to know before manually adding that URL to the filtering exclusions.

Hi SantiBailors,
I can’t answer that, but I will contact Staff and see if I can find out more information.

Kind regards.

[snadge]

thanks CaptainSticks, just it would be best if they whitelisted it via an update as this could cause issues for others trying to access a legit website.

[Muyfa666]

I can’t for my life get Website filtering to do anything really.

http://www.rarlab.com/ is blocked and no matter how I try to add it, it’s still blocked.

The only way I get it working is my disabling Website Filtering completely. Bummer.

Can someone walk me through it?

[Citizen_K]

Muyfa666, I merged your topic with an already existing one.

[captainsticks]

@Muyfa666 post:18

I can’t for my life get Website filtering to do anything really.

http://www.rarlab.com/ is blocked and no matter how I try to add it, it’s still blocked.

The only way I get it working is my disabling Website Filtering completely. Bummer.

Can someone walk me through it?

Hi Muyfa666,
Under the ‘Categories’ tab of the website filtering settings, right click the exclusions category and select ‘Add Website’.
Add www.rarlab.com and select OK, then select OK again to close the advanced settings screen.

Kind regards.

[SanyaIV]

@captainsticks post:20

Hi Muyfa666,
Under the ‘Categories’ tab of the website filtering settings, right click the exclusions category and select ‘Add Website’.
Add www.rarlab.com and select OK, then select OK again to close the advanced settings screen.

Kind regards.

Just to add to that, in the website filtering settings, make sure “Allowed Websites” is positioned ABOVE “Blocked Websites” (Seen a few cases where Blocked websites have been above and hence had a higher priority which means the exclusions aren’t working)

[captainsticks]

Thanks for pointing that out Sanya. :-TU

[Muyfa666]

Actuallt, I got that far by myself. Doesn’t work thou.

[captainsticks]

@Muyfa666 post:23

Actuallt, I got that far by myself. Doesn’t work thou.

Hi Muyfa666,
I am not sure why it still fails for you.
Once you have added it to the website filtering exclusions have you tried clearing your browsing data, or tried a different browser?

Thanks.

[wasgij6]

instead of adding www.rarlab.com try using *rarlab.com or rarlab.

[Muyfa666]

I tried it all, adding three entries; www.rarlab, rarlab.com and rarlab. I also moved allowed sites to the top.

No go.

Then I deleted all these settings, and tried to add just www.rarlab.com and now it works. Weird.

Since it work I won’t question it anymore thou…

[SanyaIV]

@Muyfa666 post:26

I tried it all, adding three entries; www.rarlab, rarlab.com and rarlab. I also moved allowed sites to the top.

No go.

Then I deleted all these settings, and tried to add just www.rarlab.com and now it works. Weird.

Since it work I won’t question it anymore thou…

Let me explain why, when you enter a website to the exclusions rule, it doesn’t want a keyword, it’s a full URL it expects, so adding “www.rarlab” won’t work because the domain has “.com” after that meaning that it doesn’t match the full URL, similarly “rarlab.com” doesn’t have the “www.” part and “rarlab” has neither, but when you entered “www.rarlab.com” that is an exact match and hence will be allowed. The literally interpretation of the website entries is why we have wildcards like “" and “?” where "” matches any amount of symbols (which is why washij6 suggested “rarlab.”) and where “?” matches any one character.

[Muyfa666]

Sorry, I missed the * in the post.

No matter. It does work now. Thank you all.