Which filters webpages first? IMON or Proxomitron?

Hi Everyone,

When filtering a webpage, probably a firewall (that filters out ActiveX, Java, and Javascript) would get the first go at filtering a webpage.

But then would Proxomitron be next?

Or would the IMON HTTP scanner be next?

And where does the Admuncher filter fit in?

 

Hi Ronjor,

But if you do use both, who gets to filter/scan the webpage first?

Let's say you type in Google.com in Firefox.
Does the page come into Proxomitron first where it is filtered.
Then Proxomitron passes the filtered page to the IMON HTTP scanner.
Then the IMON HTTP scanner passes it on to the browser.

Is that how it works?

 

Thanks Ronjor!

 

Well, I would hope it would be filtered by Proxo first! That is the entire point of using Proxo - to see the internet as I wish to see it. And why one would not use Proxo because IMON HTTP filtering is available is absurd IMO. IMON doesn't stop gif animation does it? IMON doesn't stop ads does it? etc. etc. etc.! IMON just clutters up, messes up and slows down your computer.

There is no need for anyone using Proxo to use IMON HTTP filter. I certainly don't and may leave NOD32 because it is now absurdly redundant since it has chosen to emphasize IMON HTTP filtering instead of placing all the emphasis where it should be which is with AMON. I feel that if I renew this license that I am paying for unneeded junk in addition to getting an AMON that has been improved but still is nothing like the resident monitor of some other avs.

 

So then if you have Firefox set to use Proxo on port 8080 and IMON HTTP scanning port 8080, when you request a page in firefox, Proxo gets it first then passes it to IMON then IMON passes it to Firefox?

Or does IMON fight with Proxo and try to deliver the page to Firefox scanned (with IMON) but unfiltered (bypassing Proxo)?

 

if you are using proxomitron and you have your firewall configured correctly, the only way you will see the page is if it goes through proxomitron.

 

Huh? I don't understand. So you have Proxo on bypass now so that IMON can filter the pages and Proxo doesn't? That doesn't make sense...so I am missing something?

 

So then in your case Ronjor, Firefox is using Proxo (port 8080), then IMON doesn't scan the page? It goes from Proxo straight to Firefox? Sorry for asking all these questions, I just don't have a clue.

 

i think that that is just how nod updates. it still goes through proxo>nod>browser. looks like a first-ronjor got out-of-bed the wrong-side
EDIT sorry i didnt see your post ron. looks like i got out of bed on the wrong side. sorry ron

 

I didn't think it was possible to get around Proxo unless bypassing it. I don't think you were getting around Proxo for the updating either. NOD32 just automatically detected your IE settings which use Proxo. How could you update otherwise? All interaction with the internet goes through Proxo unless you bypass it.

 

I thought you Major Senior Members were the gurus!

Please do correct me if I'm wrong but isn't IMON for scanning emails only? If so, wouldn't its HTTP filter then be restricted to HTML emails? (HTML emails would not be filtered by Proxomitron since they did not arrive via HTTP).

NOD32's update setup (where you can route its connection via a proxy) seems a separate issue altogether and it is probably unlikely that routing via Proxomitron would make much difference (it is quite possible that it is not using HTTP for downloading updates).

 

Hi Paranoid2000,

That was the case for the previous version.
The new version of IMON has an HTML scanner to scan for malware on webpages. How effective it is, how it works, what it specifically protects against, whether it can be fooled by encoded characters, is a mystery. Here is a link on its HTTP Scanning.
From the very limited info provided, it seems to concentrate on individual infected files rather than parsing the HTML document for exploitive malicious code. But I could be wrong.

It is really the IMON HTTP scanning that I was interested in. The update doesn't need to use Proxo.
I looked in the settings for the IMON HTTP scanner. It had one field:
Ports used by HTTP protocol: 80, 8080, 3128
There is also a check box labled: Automatically detect HTTP communication on other ports too. It was checked.
And then a radio button choice for what to do when an incoming infiltration from the internet is detected.

Based on this, what do you think?
Is it Proxo>IMON>Firefox? Or does Proxo and IMON scan/filter it at the same time and then fight over who will deliver it to the browser?

 

Of course updating uses HTTP. NOD32 uses the internet settings that you have for IE. When you install NOD32 you are asked if you wish NOD32 to automatically detect your proxy settings. If you say yes, then it uses the settings you have for IE which means it goes through Proxo. If you say no, then you have to later manually set NOD32 to go through Proxo.

I just recently tested another av and I could not update. Tech support first insisted that I uninstall Proxo!!! Geez! I told them no way! I would forget their av immediately if that was their only solution. So, then the US distributor and the technicians for the AV in Europe both installed Proxo on their computers. They had no problems using Proxo to get the av updates. (I had tried to tell them I was sure it was not a Proxo problem but they wouldn't listen).

Proxo filters the web pages first. Then IMON. It is overkill. No need for IMON filtering if you have Proxo especially depending on whose filters you are using. (That reminds me this other av decided that it was my filters causing the problem as they had just installed the default Proxo and so I had to send the filters I use too...all the while I was sure Proxo had nothing to do with the updating problem as they learned when they installed my filters and had no trouble updating). Proxo with good filters will provide sufficient protection along with AMON and IMON for email if you really want that redundancy.