• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

This forum thread needs a solution.
Kudos0

NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

Dear Norton Technical Support,

I have the question for Norton Technical Support, why my Norton Security (ver 22.10.1.10) allow the EICAR Test file (taken from www .eicar . org(link is external)) downloaded to my computer didn't block it, I knew this file has stayed in my computer after I did the full scan, then this file removed as indicated a virus.

Another question is why the Download Insight very slow to block the virus file (please see attached, capture during test file using EICAR File), the file already download it in partial and the Download Insight still analyzing the file, so I doubt the performance of my Norton Security.

Please advise me how to solve this problem.

Thanks & B/regards,

Handjojo  

Replies

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

handjojo189:

(please see attached, capture during test file using EICAR File)

Don't see anything attached.

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

Dear all please find enclosed the screen shot...sorry I have been difficult to upload the attachment screen shot.

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

Hello

Here are the instructions on how to add a image to your post.

https://community.norton.com/en/forums/how-post-image-forums-0

Thanks

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

handjojo189:

Dear all please find enclosed the screen shot...sorry I have been difficult to upload the attachment screen shot.

I see Norton processing a download. The file will not be executable / readable until that finishes. Unless you are saying it never finishes, then that's unusual.

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

Thank you for your explanation, however I rather confused about the Norton approach to handle the malicious download file, its seem reactive not proactive, Norton allow to download a file then block the executable file when arrive to the computer (with .com extension, with the Zip or txt it will be block when the user access it), It's not block it at begining but allow download it, if I'm not wrong to interpreted it.

B/regards 

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

Download Insight protects your computer against any unsafe file that you may run or execute after you download it using a supported browser. By default, the Download Intelligence option is turned on. In this case, Download Insight notifies you about the reputation levels of any executable file that you download. The reputation details that Download Insight provides indicate whether the downloaded file is safe to install.

Container files such as Zip files are scanned by AutoProtect but only as raw files. The individual files embedded within container files are not scanned by AutoProtect. If you try to extract the files and run them, however, AutoProtect will detect them. Manual scans will scan within container files if the product is configured to do so.

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

handjojo189:

Thank you for your explanation, however I rather confused about the Norton approach to handle the malicious download file, its seem reactive not proactive, Norton allow to download a file then block the executable file when arrive to the computer (with .com extension, with the Zip or txt it will be block when the user access it), It's not block it at begining but allow download it, if I'm not wrong to interpreted it.

B/regards 

How could Norton check the file before Norton had the file?

Kudos0

Re: NORTON SECURITY 22.10.1.10 ALLOW EICAR TEST FILE ARRIVE TO MY COMPUTER

"Once downloaded run your AV scanner. It should detect at least the file "eicar.com". Good scanners will detect the 'virus' in the single zip archive and may be even in the double zip archive. Once detected the scanner might not allow you any access to the file(s) anymore. You might not even be allowed by the scanner to delete these files. This is caused by the scanner which puts the file into quarantaine. The test file will be treated just like any other real virus infected file. Read the user's manual of your AV scanner what to do or contact the vendor/manufacturer of your AV scanner."
http://www.eicar.org/85-0-Download.html

It seems to be working as EICAR states in the bold text above. Norton Security detects the test file in the .zip compressed file when you perform an on-demand scan. If you attempt to unzip the folder it would detect it again and quarantine or delete the file.

Screenshot of the EICAR zip folder being extracted and Norton detecting it and removing it;

Screenshot of all non-zip files/folders being detected and blocked by Norton;

Windows 10 Pro 64-bit / Norton Security v.22.17.x

This thread is closed from further comment. Please visit the forum to start a new thread.