Kaspersky not blocking when it says it is

neiby · 07-17-2009, 07:39 AM

I saw that Kaspersky said it blocked a virus download for someone and thought I'd see what kind of virus it was. It was a legitimate business site that had the file. I thought I'd download it and then submit it to online scanners to see what viruses it had. I tried downloading it with KAV enabled. KAV said that it blocked the file, but I had no problem downloading it. I tried this with HTTP resume enabled and disabled. No difference.

What is the proper behavior of KAV when a user downloads a file? I know that it blocks EICAR completely. So why would it say it was blocking this other file and then let me download it?

BTW, in the online tests, Kaspersky said this was not a virus, but four other vendors did.

WebFooL · 07-17-2009, 07:42 AM

Hi,
Is it a "Top Secret" file or can you post a link?

neiby · 07-17-2009, 07:46 AM

It is not top secret.

http://securelink.intergraph.com/downloads.vm

Download the file for Windows. KAV seems to let you download it, but marks it as blocked in the event logs. I suspect it's a false positive anyway, but it still seems like odd behavior.

07-17-2009, 07:39 AM	#1 (permalink)
neiby Master Untangler Join Date: Jun 2009 Location: Denver, CO Posts: 603	Kaspersky not blocking when it says it is I saw that Kaspersky said it blocked a virus download for someone and thought I'd see what kind of virus it was. It was a legitimate business site that had the file. I thought I'd download it and then submit it to online scanners to see what viruses it had. I tried downloading it with KAV enabled. KAV said that it blocked the file, but I had no problem downloading it. I tried this with HTTP resume enabled and disabled. No difference. What is the proper behavior of KAV when a user downloads a file? I know that it blocks EICAR completely. So why would it say it was blocking this other file and then let me download it? BTW, in the online tests, Kaspersky said this was not a virus, but four other vendors did. __________________ Disclaimer: I may or may not have had enough coffee when I'm posting. Interpret my responses thusly.

07-17-2009, 07:42 AM	#2 (permalink)
WebFooL Join Date: Jan 2009 Location: Sweden (Eskilstuna) URLs submitted: 57 Posts: 3,882	Hi, Is it a "Top Secret" file or can you post a link? __________________ "Of all the things I've lost, I miss my mind the most" Untangle Reseller (Sweden) WebFooL@fakenews.se http://fakenews.se/ Need space to Upload content for you forum post? http://about.me/webfool

07-17-2009, 07:46 AM	#3 (permalink)
neiby Master Untangler Join Date: Jun 2009 Location: Denver, CO Posts: 603	It is not top secret. http://securelink.intergraph.com/downloads.vm Download the file for Windows. KAV seems to let you download it, but marks it as blocked in the event logs. I suspect it's a false positive anyway, but it still seems like odd behavior. __________________ Disclaimer: I may or may not have had enough coffee when I'm posting. Interpret my responses thusly.

Protect

Filter

Perform

Connect

Manage

Add-Ons