Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a virus scanner installed (avast on Windows 8) and it blocked the access to malicious websites in Chromium. There's no proxy activated in Chromium so how is the scanner capable of rejected a connection to some websites? Is there some kind of kernel module that has a low level access?

share|improve this question
    
Some virus scanners install their browser extension in the system so they can control the browser and block access to malicious websites. –  Jijo John Jul 1 '13 at 17:30

2 Answers 2

up vote 6 down vote accepted

Anti-virus (AV) software usually install their own NDIS Intermediate Drivers or Windows Filtering Platform Callout Drivers which allows them to tap into the network traffic, modify it, drop it, divert it, and basically do whatever they want.

So when your browser sends a request to a potentially dangerous website, the AV sniffs the HTTP request parameters and compares the URL to a list of blacklisted URLs and when it finds it there it drops request. It's even capable of responding to your browser with a page telling you that the request has been blocked.

share|improve this answer

You AV product probably uses DLL injection to intercept the requests to be initiated by your browser:

http://www.file.net/process/aswwebrepie.dll.html

It is possible to achieve similar or higher level of control by filter drivers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.