FortiClient realtime protection does nothing.

[dan_newcombe]

I have this marked as with 5.6, but same thing happens with 6.0

I have a word document that has WM/Agent.Ml!tr in it as a macro.   It is in an e-mail.  From outlook, I can save it to my desktop, copy it on my desktop and user directory, open it in word (not enabling editing/macros!).   And if I disconnect the VM from the network and enable editing/macros, it saves the payload in %APPDATA% and starts the exe.

While doing this FortiClient does nothing, even though Realtime Protection is enabled, file-based malware scanning is enabled.  

But if I right click on the word file and scan with FortiClient Anti-Virus, it identifies and quarantines it.

If I right click on the payload (aborigines.exe) and scan it, it identifies it as W32/Generic.AP.F2D0!tr

So any ideas as to why the real-time protection does nothing?

[dan_newcombe]

And to make things interesting, I opened notepad, pasted the string that makes up the EICAR virus into it and saved it as eicar.exe and it was immediately quarantined.     So it does work somewhat.  Just why it doesn't catch the infected word document, or the payload it drops doesn't make sense.

[Markus]

Thats really dubios, never testet, nor seen that behaviour. Did you open a TAC?

[dan_newcombe]

No, I haven't put one in yet.  I noticed the behaviour, was curious if it's been seen before.  I passed the info along to our internal forticlient and fortigate experts for them to figure out and create a case if needed.