Norton & Compressed Files

[Deleted member 2913]

I didn't knew Norton could have download insight on compressed files too.

I downloaded a harmless sample from testmypcsecurity called keylogtest. Its in zip.

I extracted & Norton detected it. I checked quarantine & the detection at the end mention download insight.

If I disable Norton auto-protect & extract keylogtest, enable auto protect & open the extracted folder or execute keylogtest then Norton doesn't detect it. With auto-protect enabled if I again extract it to the same folder then Norton detects it.


Plzz test & verify.

If malware hub testers here disable autoprotect to extract the samples then Norton would not detect the samples, offcoz if the above is correct & the samples in question are download insight detection & not signs, sonar, etc...

 

[Daniel Hidalgo]

When I used norton the first times in the hub, I disabled them self-protect extracted and into a normal scan, and how did the results were not positive.
However nevertheless not disable auto-protect and download the samples (in a VM, of course) and the extract and Download Insight detected and automatically, eliminated. Having positive results (which I personally surprising)
Download Insight and SONAR (in my opinion) are the most powerful tools in Norton, however this depends on self-protect.

If I disable Norton auto-protect & extract keylogtest, enable auto protect & open the extracted folder or execute keylogtest then Norton doesn't detect it. With auto-protect enabled if I again extract it to the same folder then Norton detects it.

I think it could be a bug, just that it would be illogical norton which was first detected (by Donwload Insight) and no time after (it happened to me too)

 

[Daniel Hidalgo]

It could also be that in the first case the detention is based on the insight network and in the second case no juna signature on the database and therefore was not detected

 

[Deleted member 2913]

I mentioned in my first post that the detection should be download insight detection. Offcoz if the detection is sign detection then it would be detected as signs are locally or cloud present, similarly sonar BB.

I dont know how download insight detection works?

But the case I mentioned with keylogtest sample is not like happened that time i.e its repeatable i.e any time I try that way its not detected.

 

[bjm_]

Based on the type of application you use to download your file, your Norton product does one of the following:

• Analyzes the file based on its reputation details when the download is complete.
• Analyzes the file based on its reputation details when the file is executed.

 

[Daniel Hidalgo]

I dont know how download insight detection works?

Download Insight uses reputation information exclusively when it makes decisions about downloaded files. It does not use signatures or heuristics to make decisions. If Download Insight allows a file, Auto-Protect or SONAR scans the file when the user opens or runs the file.


Managing Download Insight detections

 

[Deleted member 2913]

You can test Norton & see if the result is same. Its harmless sample like eicar, etc...

http://cdn.download.comodo.com/securitytests/keylogtest.zip

 

[Ink]

Archive files without password-protection can be detected/flagged almost immediately (no extraction required).

 

[Daniel Hidalgo]

Is correct if the compressed file is not password as mentioned @Huracan can be analyzed what this within the zip file

I've been tested disabling auto-protect, on-demand scanning was not detected but again enable auto-protect and run the norton file is detected is removed by download insight, my conclusion is this (maybe I'm wrong) as such the file does not have a signature in the database, but is detected via cloud (for the insight network).

 

[Deleted member 2913]

I've been tested disabling auto-protect, on-demand scanning was not detected but again enable auto-protect and run the norton file is detected is removed by download insight

Can you test the keylogtest sample & see what happens in your case?

 

[Daniel Hidalgo]

Can you test the keylogtest sample & see what happens in your case?

in my case, disable auto-protect, it extracted and made an analysis on demand which was not detected, then enable auto protect and run was when it was detected file.


Norton settings that you have?

 

[Venustus]

In my case with all settings at MAx,Norton did not detect the archive even upon extraction!
Upon executing:

 

[Deleted member 2913]

venustus,

You disabled autoprotect & extracted keylogtest & enabled autoprotect & executed keylogtest, right?
If you did the above then yes even on execution the sample is not detected.

 

[Venustus]

venustus,

You disabled autoprotect & extracted keylogtest & enabled autoprotect & executed keylogtest, right?
If you did the above then yes even on execution the sample is not detected.

No, I did not disable autoprotect!!
Do I have to disable it then execute?

 

[Deleted member 2913]

If you didn't disable autoprotect then the sample should be detected, strange, dont know why it was not detected?

Are you using Norton Security or previous NIS or something? Dont know if there is difference or not?

 

[Venustus]

If you didn't disable autoprotect then the sample should be detected.

In my case it is not detected

 

[Venustus]

If you didn't disable autoprotect then the sample should be detected, strange, dont know why it was not detected?

Are you using Norton Security or previous NIS or something? Dont know if there is difference or not?

The latest Norton Security 22.6
If you get a detection, then I must have something misconfigured??
Could you please confirm that you or any one else gets a detection?
Thanks!!

I went here:
Feature Settings Check – Download of Compressed Malware » AMTSO

The archive was not detected, but the file was detected upon extraction!

 

[Deleted member 2913]

I was trying it.
I have Norton Security installer 22.5.4.24. I didn't updated it as was just trying it. Later I uninstalled.

 

[Ink]

In my case with all settings at MAx,Norton did not detect the archive even upon extraction!
Upon executing:

The software in the .ZIP file requires .NET Framework by Microsoft for it to run successfully.

I was trying it.
I have Norton Security installer 22.5.4.24. I didn't updated it as was just trying it. Later I uninstalled.

Norton Security is the install-and-forget type of security software, even a notice could use it, so what was your verdict?

 

[Venustus]

The software in the .ZIP file requires .NET Framework by Microsoft for it to run successfully.

Thanks!
Would that explain the miss?
I do have a newer verion of Net F.. installed.