Blocking AVG 8.5 / IE6

NetHosted Customer Joined: 22 May 2006 Posts: 78

I have learned about the apparent DoS attacks that are actually being caused by the latest version of AVG, apparently it pretends to be a human and hits all links on a page with the browser ID "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)", which can sap up bandwidth and potentially cause servers to crash under load.

I know my own little website is not going to get hits like a corporate one, but I would like to block this browser signature and help keep my host's servers running smoothly. I would also like to have a meaningful error message should a real person be denied access by my block.

Can anyone advise on if it's possible and how I could do this for my domain here please?

Thanks.

NetHosted Staff Joined: 22 Mar 2004 Posts: 5625

Hi,

Although admirable I gather that AVG is using the exact same User Agent string as IE. Blocking AVG would therefore block everyone using IE...

You can read more here:

http://www.theregister.co.uk/2008/06/26/avg_disguises_fake_traffic_as_ie6/

Thanks,

Andrew

NetHosted Customer Joined: 22 May 2006 Posts: 78

I'm quite happy to block all IE6 users as well. They will get a message stating that it's AVG's fault I have had to block them, with information about alternative browsers and upgrading to IE7.

I do wonder, though, what will happen if AVG decide to change the user agent sig to IE7 or some other popular browser...

NetHosted Staff Joined: 22 Mar 2004 Posts: 5625

Hi,

I see, well you can redirect user based on user-agents via .htaccess. For example:

NetHosted Customer Joined: 22 May 2006 Posts: 78

Hmm. Thinking about this, what actual bandwidth is used when something such as the AVG link checker thing makes a hit on one of my pages? Is the complete page sent (pictures and all) to the phoney client?

The .htaccess rewrite information is very interesting and I may try it out anyway, ask a few friends what they see and what their initial reaction is.

NetHosted Staff Joined: 22 Mar 2004 Posts: 5625

Hi,

Yes I believe the tool checks pages for malware by loading them in advance of a click by the user.

Thanks,

Andrew

NetHosted Customer Joined: 22 May 2006 Posts: 78

OK, for some reason the line

NetHosted Staff Joined: 22 Mar 2004 Posts: 5625

Hi,

I think you'll need to escape certain characters such as ; e.g. \;

Thanks,

Andrew

Posted: Sun Jun 29, 2008 9:05 pm Post subject:

RewriteCond uses regular expressions.

You need to escape the parentheses with backslash.
Semi-colon is not a special character in regex so doesn't need to be escaped.

Dots are special (they match any single character), so technically they should also be escaped, but in this case it probably doesn't matter if they're not.

Give this a try:
RewriteCond %{HTTP_USER_AGENT} ^Mozilla/4\.0 \(compatible; MSIE 6\.0; Windows NT 5\.1; SV1\)

Posted: Mon Jun 30, 2008 8:37 am Post subject:

AVG has recently changed the user agent strings they use and I guess it is more than likely that they will do so again in the future.
http://www.theregister.co.uk/2008/06/26/avg_disguises_fake_traffic_as_ie6/

About 30% of users use IE6 at the moment with Win2K users being unable to upgrade (IIRC) to IE7. That is quite a lot to block.

NetHosted Customer Joined: 22 May 2006 Posts: 78

Thank you all for your help and advice with this. Could I ask you to take a look and tell me what results you get please? In theory it should only block IE6...

http://www.jonathanmortimer.co.uk

NetHosted Customer Joined: 22 May 2006 Posts: 78

NetHosted Customer Joined: 06 Oct 2006 Posts: 156

>had to escape all of the spaces too
Sometimes in .htaccess you can just put it all in double quotes to avoid having to escape the spaces (but even if this works you'd still have to escape the parentheses). The spaces would definitely be required since otherwise you'd have a space in the user agent string which would fail to match whatever character was in the corresponding position in the regex.

I don't know what the typical impact on bandwidth/server load is, but AVG 8 made my PC grind to a halt (well I get 100 results from Google at a time) so I took the uninstall option pretty swiftly

NetHosted Customer Joined: 22 May 2006 Posts: 78

NetHosted Staff Joined: 22 Mar 2004 Posts: 5625

This has hit slashdot now. Someone has come up with this set of rewrite rules: