• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Norton does NOT block the EICAR test virus.

I would love to give Norton an "Excellent" rating, but you don't block viruses very well.

For example, Bitdefender will completely block the 'eicar_com.zip' virus by blocking the entire PAGE on the EICAR website (http://www.eicar.org/). 

However, Norton allows the file to be downloaded to the computer. Norton doesn't even check it to see if it's safe!! It appears that Norton is NOT good at blocking .zip files that contain viruses.

Now....you can IGNORE this little fact if you want to, but I WILL post this information to as many forums as I can. All people have to do is check for themselves.

Do better or I WILL be using Bitdefender from now on!! AV-Comparatives consistently has it among the top five anti-virus software suites!

And this is Norton's response:

"Sorry, Lamar. I would like to clarify that http://www.eicar.org/is a safe website. It is used by most of the anti virus enthusiasts to safely test their anti virus programs. The website does not contain any injectable/auto-run threats or PUPs. So the website is not being blocked by SafeWeb and Vulnerability protection. However, when you try to download the file, Norton Download Insight will scan all executable files. If the download is a zip file, Norton Download Insight will scan and remove as soon as you try to access the file. Please let me know if this helps. -raj"

My response:

"NO, IT DOESN'T!!

Why are you lying? 

Norton does NOT scan and remove the compressed file!! I have PROVEN this by downloading the file, then checking it in the Download folder. It is NOT removed until I scan it myself!!"

Norton's response:

"Sorry, could you try downloading the file again and try to open the executable file in it with out a manual scan? Norton should block it. -raj"

My response:

"I downloaded it, I opened it, and Norton did NOT block it UNTIL I tried to run it as an executable!!

Norton should completely BLOCK it BEFORE it even gets onto my computer.....like BITDEFENDER does!!"

Basically, I just wanted to let Norton users know about how Norton handles the EICAR test virus. It SHOULD block it, but it doesn't! Norton should block a virus, not allow it to be downloaded, and THEN remove it. Bitdefender BLOCKS the virus, and does NOT allow it to get on to the computer in the first place.

Replies

Kudos1 Stats

Re: Norton does NOT block the EICAR test virus.

Use BitDefender if you want but zipped files are harmless until they are extracted.

Windows 10 x64 1909 | Mint Cinnamon 19.3 | Solus Plasma 4.1 | Kubuntu 20.04
Kudos0

Re: Norton does NOT block the EICAR test virus.

The zip file is JUST an example. 

Other test sites can download files, Norton will see them, then remove them.

Bitdefender BLOCKS the site/page. I don't want a possibly harmful file to be downloaded, THEN removed. I want it blocked from ever getting on to my computer.

Kudos0

Re: Norton does NOT block the EICAR test virus.

Did you try to open the Zip file as suggested by the Support rep? It should be blocked then.

Things happen. Export/Backup your Norton Password Manager data.
Kudos0

Re: Norton does NOT block the EICAR test virus.

Yes. I opened the zip file. It was not blocked until I double clicked the .exe. 

It should NOT let me get to that point.

Kudos3 Stats

Re: Norton does NOT block the EICAR test virus.

Shawn Noyb:

It should NOT let me get to that point.

Norton is not the only AV product that does not automatically scan compressed files.  In order to adequately scan inside a compressed file, an antivirus needs to unpack it which takes time, and you cannot be infected by a .zip file until you open it anyway.  Auto-Protect will catch anything on access that it would have detected on a compressed file scan, so there is no security benefit to doing it either way, and not scanning by default saves time and resources.  Just for reference, here is F-Secure's documentation on using the Eicar test file with its product:

See how harmful files in an archive are detected:

By default, compressed or archive files, such as ZIP files, are not scanned in real time. F-Secure's antivirus products scan the archive files automatically once you attempt to extract or execute their content.

  1. Download the eicar_com.zip file and save the file to your computer.
    Note : To test nested compressed files, use eicarcom2.zip.
  2. Try to exctract the ZIP file or execute one of the files within the ZIP file.
  3. Right-click the eicar_com.zip file and select Scan eicar_com.zip for viruses.

 https://community.f-secure.com/t5/Common-topics/Testing-your-virus-prote...

Kudos0

Re: Norton does NOT block the EICAR test virus.

Shawn, as the others have said zipped files are harmless until opened.

Norton will still protect you in other ways as SOJ has pointed out !

This thread is closed from further comment. Please visit the forum to start a new thread.