Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
dan_newcombe
New Contributor

FortiClient realtime protection does nothing.

I have this marked as with 5.6, but same thing happens with 6.0

 

I have a word document that has WM/Agent.Ml!tr in it as a macro.   It is in an e-mail.  From outlook, I can save it to my desktop, copy it on my desktop and user directory, open it in word (not enabling editing/macros!).   And if I disconnect the VM from the network and enable editing/macros, it saves the payload in %APPDATA% and starts the exe.

 

While doing this FortiClient does nothing, even though Realtime Protection is enabled, file-based malware scanning is enabled.  

 

But if I right click on the word file and scan with FortiClient Anti-Virus, it identifies and quarantines it.

If I right click on the payload (aborigines.exe) and scan it, it identifies it as W32/Generic.AP.F2D0!tr

 

So any ideas as to why the real-time protection does nothing?

3 REPLIES 3
dan_newcombe
New Contributor

And to make things interesting, I opened notepad, pasted the string that makes up the EICAR virus into it and saved it as eicar.exe and it was immediately quarantined.     So it does work somewhat.  Just why it doesn't catch the infected word document, or the payload it drops doesn't make sense.

Markus
Valued Contributor

Thats really dubios, never testet, nor seen that behaviour. Did you open a TAC?


________________________________________________________
--- NSE 4 ---
________________________________________________________

________________________________________________________--- NSE 4 ---________________________________________________________
dan_newcombe

No, I haven't put one in yet.  I noticed the behaviour, was curious if it's been seen before.  I passed the info along to our internal forticlient and fortigate experts for them to figure out and create a case if needed.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors