IMON question

i test IMON by downloading eicar test file from nod32sse.com (i use IDM integration with firefox 2) and imon let it downloaded ??!! when i check nod32 log it said that virus detected and connection terminated. ive set idm to higher efficiency. imon work well if i dont use idm.

 

FF 2.0 Bypasses Imon

Just tried the Eicar download from nod32sse and using FireFox 2.0 the file downloaded without any interaction from Nod32 2.7.23. Has FF changed in some way IE7 the d/l gets terminated but not in FF. Anyone else confirm or is it just my settings ?

 

Re: FF 2.0 Bypasses Imon

it seems that idm cause it. i change with another download manager and work fine now.

 

Re: FF 2.0 Bypasses Imon

I'm just using standard FF 2 with download manager tweak and no matter what settings I use it still gets past Nod32

 

I am running FF 2.0.0.1 with NOD32 2.70.23. I tested the Eicar file and NOD32 caught it and reported file in Threat Log. What download manager tweak are you using?

 

I'm using 2.0.0.1 too and this extension.

Cheers

 

I installed the extension and restarted FF. NOD32 still had no problem with the Eicar virus.

 

I've double checked my settings and uninstalled the extension, NOD still lets me download the eicar test file. and nothing in the threat log

 

have you set your client compatibility setting in NOD32 http scanner(IMON) ? set to high efficiency

 

Tried that made no difference. Also tried running FF in safe mode with all extensions disabled and re-installing both FF and Nod32 and it still bypasses nod32 and lets me download. I tried the test files from eicar.com and they were blocked - all of them, just not the test file on nod32sse.com. IE7 blocks ok just FF that doesn't.

 

Hi Ron thats what I get on the eircar site but the test file on nod32sse.com totally bypasses Nod32, I'm worried that someone will exploit this weakness.

 

Hi RonJor I don't get that warning with the nod32 site for some reason despite re-installing Nod32 using BS settings and Firefox 2. I used to get that warning before I updated to FF 2 but now I don't. I have no option to terminate the download but with IE7 I get the warning Dialog.

 

I think you have fixed it Ron. Safe mode in FF didn't help but resetting Imon to the default settings seems to have fixed it.

I still don't get the warning dialog but Imon seems to clean the Zip file of the infection and quarantine it now and download the empty multiple zip files. Imon says infections detected 1 and cleaned 1 thats good enough for me cheers Ron.

Edit: I spoke to soon. It's not repeatable it still downloads the zip file with eicar.com in tact. I think the cleaned file was from the eicar.com site that I tested before. I'm really stuck now - help!

 

A couple of things:

Is Port 80 included in the IMON->Setup->HTTP protocol?
Did you try FF with the default theme?
What other extensions do you have installed?

 

Yes port 80 is included and I tried in FF safe mode with all extensions and themes disabled - still the same behaviour. Any more ideas ?

 

You sure IMON is set to scan archives?

 

Works fine with Opera, but what do you mean by 'Not sure where it went but I can't find it.' Surely when the download is terminated, as you did, that's it, no download of the malicious file(s).

 

Thanks ronjor, and Merry Christmas.

 

Yes, like I say if I download the file in IE7 Nod32 blocks it with a warning window offering me the option to terminate it. This is what I get with IE7. FF just happily downloads the file.

 

Hmm.. Try these
1. http://dl.nod32sse.com/eicar.rar
2. http://dl.nod32sse.com/eicar.zip
3. http://dl.nod32sse.com/eicar.com

 

All of those were blocked by Nod32 which popped up the red warning dialog in Firefox. Could it be how firefox gets the file ?