Re: [twsocket] OT: 3Proxy malware?
Arno, I'll post a message to the 3proxy's forum and give a link to this thread so that 3APA3A could be aware. -- Anton -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Anton S. wrote: >> Is there some switch to turn that on? >> I just tried briefly yesterday and it returned HTTP/1.0 >> responses to my HTTP/1.1 request. > > Don't know, it should simply work! Are you sure to use latest version? > I now tried to test with Opera with option "Use HTTP 1.1 for proxies" > enabled but it used to send GET requests with "HTTP 1.0". I don't > know how to force 1.1 mode. It doesn't support HTTP/1.1 properly. All responses are HTTP/1.0. It's a bit buggy also the SOCKS part :( Anyway I just checked in a change to support 3Proxy as well. Log: Fixed a memory overwrite bug in TCustomHttpTunnelWSocket DataAvailable. Improved keep-alive handling and removed the hard check for correct HTTP version. It still supports HTTP/1.1 only, however is now partly compatible with 3Proxy. It has been tested successfully with WinGate, Sambar, Fastream IQ Proxy Server and 3Proxy. Note that detection of authentication type works only with persistent connections, with 3Proxy you have to explicitly set the authentication type. You can test it easily with new OverbyteIcsFtpTst and OverbyteIcsMailSnd demo. -- Arno Garrels -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
>Is there some switch to turn that on? >I just tried briefly yesterday and it returned HTTP/1.0 >responses to my HTTP/1.1 request. Don't know, it should simply work! Are you sure to use latest version? I now tried to test with Opera with option "Use HTTP 1.1 for proxies" enabled but it used to send GET requests with "HTTP 1.0". I don't know how to force 1.1 mode. BTW, regarding "malwareness": developer refers to this link to read http://vil.nai.com/vil/content/v_100768.htm -- Anton -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Anton S. wrote: > Arno, > > "18/02/2009 3[APA3A]tiny proxy 0.6 > New features since 0.5 are marked with !. > > Features: > 1. General > + HTTP/1.1 Proxy with keep-alive client and server support, > transparent proxy support." Is there some switch to turn that on? I just tried briefly yesterday and it returned HTTP/1.0 responses to my HTTP/1.1 request. -- Arno Garrels > > http://3proxy.ru/0.6.1/Release.notes.txt > > and this software is unlikely a trojan. I used it for long time, > speaked with developer. And it also opensource. Maybe AV's detect its > net communication parts. > > -- > Anton -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Arno, "18/02/2009 3[APA3A]tiny proxy 0.6 New features since 0.5 are marked with !. Features: 1. General + HTTP/1.1 Proxy with keep-alive client and server support, transparent proxy support." http://3proxy.ru/0.6.1/Release.notes.txt and this software is unlikely a trojan. I used it for long time, speaked with developer. And it also opensource. Maybe AV's detect its net communication parts. -- Anton -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Dear Arno, On Sun, Feb 13, 2011 at 7:10 PM, Arno Garrels wrote: > Fastream Technologies wrote: > > Dear Arno, > > > > Why don't you add our ICS-based IQ Proxy Server 5.0.0C1 to your test > > againsts: > > http://www.iqproxyserver.com > > Thanks for the hint, but as I understand it is a reverse proxy, I currently > want to test the other direction with CONNECT requests (tunnel) including > NTLM and Basic authentication. > > > In 2010, we added the forward proxy module with CONNECT support as well as NTLM/Basic/Digest/forms authentication! Best Regards, SZ -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Francois PIETTE wrote: >> Testing ICS against multiple proxy servers became more difficult. >> A check of 3Proxy.exe (http://www.3proxy.ru) at www.virustotal.com >> returned plenty of positives. Are they actually positives? >> Rather unlikely since it's open source IMO. > > Microsoft Security Essential also reports as "moderate risk" and > potentially dangerous. > See: > http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Program%3aWin32%2fTinyProxy&threatid=138819 > > I understand this document only warn user that the program has a proxy > feature which is not by itself a real risk. That's my guess as well so I gave it a trial. It seems to support HTTP v1.0 only, so probably HTTP v1.0 is still in use by proxies and I have to add that to TWSocket as well. -- Arno Garrels -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Fastream Technologies wrote: > Dear Arno, > > Why don't you add our ICS-based IQ Proxy Server 5.0.0C1 to your test > againsts: > http://www.iqproxyserver.com Thanks for the hint, but as I understand it is a reverse proxy, I currently want to test the other direction with CONNECT requests (tunnel) including NTLM and Basic authentication. -- Arno Garrels -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Dear Arno, Why don't you add our ICS-based IQ Proxy Server 5.0.0C1 to your test againsts: http://www.iqproxyserver.com Regards, SZ On Sun, Feb 13, 2011 at 4:57 PM, Arno Garrels wrote: > Hi, > > Testing ICS against multiple proxy servers became more difficult. > A check of 3Proxy.exe (http://www.3proxy.ru) at www.virustotal.com > returned plenty of positives. Are they actually positives? > Rather unlikely since it's open source IMO. > > -- > Arno Garrels > -- > To unsubscribe or change your settings for TWSocket mailing list > please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket > Visit our website at http://www.overbyte.be > -- *Fastream Technologies* *Software IQ: Innovation & Quality* http://www.fastream.com | http://twitter.com/fastream | http://www.iqproxyserver.com | http://www.iqproxyserver.com/forum *Sales & Support: Email:* sa...@fastream.com, supp...@fastream.com | *Intl. Hotline:* +90-312-223-2830 (weekdays, 9am-6pm *GMT+200*) Join *IQ Proxy Server Yahoo group* at http://groups.yahoo.com/group/IQProxyServer Join *IQWF Server Yahoo group* at http://groups.yahoo.com/group/IQWFServer This is a *no-nonsense* signature! Please do *join our yahoo groups for announcements of future versions* of IQ Proxy Server and IQ Web/FTP Server (traffic level is *very low*). -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
Re: [twsocket] OT: 3Proxy malware?
Testing ICS against multiple proxy servers became more difficult. A check of 3Proxy.exe (http://www.3proxy.ru) at www.virustotal.com returned plenty of positives. Are they actually positives? Rather unlikely since it's open source IMO. Microsoft Security Essential also reports as "moderate risk" and potentially dangerous. See: http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Program%3aWin32%2fTinyProxy&threatid=138819 I understand this document only warn user that the program has a proxy feature which is not by itself a real risk. -- francois.pie...@overbyte.be The author of the freeware multi-tier middleware MidWare The author of the freeware Internet Component Suite (ICS) http://www.overbyte.be -- To unsubscribe or change your settings for TWSocket mailing list please goto http://lists.elists.org/cgi-bin/mailman/listinfo/twsocket Visit our website at http://www.overbyte.be
