Skip to main content
dan_newcombe
dan_newcombe
New Member
July 23, 2019
Question

FortiClient realtime protection does nothing.

  • July 23, 2019
  • 2 replies
  • 3932 views

I have this marked as with 5.6, but same thing happens with 6.0

 

I have a word document that has WM/Agent.Ml!tr in it as a macro.   It is in an e-mail.  From outlook, I can save it to my desktop, copy it on my desktop and user directory, open it in word (not enabling editing/macros!).   And if I disconnect the VM from the network and enable editing/macros, it saves the payload in %APPDATA% and starts the exe.

 

While doing this FortiClient does nothing, even though Realtime Protection is enabled, file-based malware scanning is enabled.  

 

But if I right click on the word file and scan with FortiClient Anti-Virus, it identifies and quarantines it.

If I right click on the payload (aborigines.exe) and scan it, it identifies it as W32/Generic.AP.F2D0!tr

 

So any ideas as to why the real-time protection does nothing?

2 replies

dan_newcombe
dan_newcombeAuthor
New Member
July 23, 2019

And to make things interesting, I opened notepad, pasted the string that makes up the EICAR virus into it and saved it as eicar.exe and it was immediately quarantined.     So it does work somewhat.  Just why it doesn't catch the infected word document, or the payload it drops doesn't make sense.

Markus
Markus
New Member
July 30, 2019

Thats really dubios, never testet, nor seen that behaviour. Did you open a TAC?

dan_newcombe
dan_newcombeAuthor
New Member
July 30, 2019

No, I haven't put one in yet.  I noticed the behaviour, was curious if it's been seen before.  I passed the info along to our internal forticlient and fortigate experts for them to figure out and create a case if needed.

Terms & ConditionsAccessibility statement