Is CA EZ Antivirus any good?

Bob wrote:
> On Thu, 02 Jun 2005 13:20:05 -0700, DaVinci <D.TakeThisOut@nospam.net> wrote:
>
>
>>Okay, I see now. Keep in mind that you always have the option to scan
>>the zip file before you extract the contents using the on-demand
>>scanner. For example, using the on-demand scanner, eTrust identifies
>>that the double zipped eicar is infected.
>
>
> Yes, but I still would like to have the option of getting CA AV to
> scan automatically before I download - like I had with McAfee.

mcafee was lying to you... you cannot scan something before it is on
your machine (either in ram or on the disk)...

and you cannot scan the contents of a zip file until you can decompress
the contents of a zip file and there may well be cases where that
requires the entire zip file to be on your system...

--
"they threw a rope around yer neck to watch you dance the jig of death
then left ya for the starvin' crows, hoverin' like hungry whores
one flew down plucked out yer eye, the other he had in his sights
ya snarled at him, said leave me be - i need the bugger so i can see"
 >> Stay informed about: Is CA EZ Antivirus any good? 

On Fri, 03 Jun 2005 14:41:06 +0200, Frederic Bonroy
<bidonavirus.DeleteThis@yahoo.fr> wrote:

>No, you didn't download it, but your browser did. While you were
>deciding what to do, i.e. while the dialog box was open, your browser
>was already downloading the file in the background to save time. That is
>common practice. Since eicar.com is such a small file, it was fully
>downloaded before you could click away the dialog box.

eicar.com is 68 bytes. eicar.com.zip is 184 bytes. Why did Mozilla
decide to preload the one and not the other?

Or did it preload the zip file but CA AV did not look inside to see if
there was a virus?

You do not have to unzip a zip file to see its contents.
 >> Stay informed about: Is CA EZ Antivirus any good? 

Bob a écrit :

> eicar.com is 68 bytes. eicar.com.zip is 184 bytes. Why did Mozilla
> decide to preload the one and not the other?
>
> Or did it preload the zip file but CA AV did not look inside to see if
> there was a virus?

No idea, I did not follow this thread.

> You do not have to unzip a zip file to see its contents.

To see the directory (the list of the items stored in the zip file), you
don't need to unzip it, no. But in order to access the actual items,
they need to be extracted from the zip file first. This can be done
automatically by software, by a virus scanner for example, and is
transparent to the user. The decompression takes place even if it's not
visible to you.
 >> Stay informed about: Is CA EZ Antivirus any good? 

On Fri, 03 Jun 2005 15:26:32 +0200, Frederic Bonroy
<bidonavirus.RemoveThis@yahoo.fr> wrote:

>To see the directory (the list of the items stored in the zip file), you
>don't need to unzip it, no. But in order to access the actual items,
>they need to be extracted from the zip file first. This can be done
>automatically by software, by a virus scanner for example, and is
>transparent to the user. The decompression takes place even if it's not
>visible to you.

OK then why doesn't CA AV do just that and thereby warn the user that
a zip file contains a virus before he downloads it?

As it is now, you have to download the zip file and then you have to
remember to scan it manually, which is something most users are not
going to do.

Then you have to unzip it and extract it to a directory before CA AV
detects it, and then CA AV does nothing about it. You end up with the
virus on your disk. If your unzip utility automatically executes the
file after you acknowledge its detection by CA AV, then you will have
infected your computer.
 >> Stay informed about: Is CA EZ Antivirus any good? 

Bob a écrit :

> OK then why doesn't CA AV do just that and thereby warn the user that
> a zip file contains a virus before he downloads it?

Perhaps it's not designed to do so, or perhaps it's not configured to do
so... I'm not familiar with this particular product.

> As it is now, you have to download the zip file and then you have to
> remember to scan it manually, which is something most users are not
> going to do.

They should, however. Unless they are willing to put some effort into
protecting themselves, they will inevitably run into trouble someday.

> Then you have to unzip it and extract it to a directory before CA AV
> detects it, and then CA AV does nothing about it. You end up with the
> virus on your disk.

Yes - but it's an inactive virus. I'm somewhat surprised that CA does
not scan .zip files. I'm pretty sure the on-demand scanner can be
configured to do so; if the on-access scanner doesn't, then it's
probably for performance reasons. But, again, I'm not familiar with CA.

> If your unzip utility automatically executes the
> file after you acknowledge its detection by CA AV,

Automatic execution is never a good thing from a security point of view.
 >> Stay informed about: Is CA EZ Antivirus any good? 

On Fri, 03 Jun 2005 18:21:38 +0200, Frederic Bonroy
<bidonavirus DeleteThis @yahoo.fr> wrote:

>> OK then why doesn't CA AV do just that and thereby warn the user that
>> a zip file contains a virus before he downloads it?

>Perhaps it's not designed to do so, or perhaps it's not configured to do
>so... I'm not familiar with this particular product.

It is not designed to do so. There is no configuration possible.
That's my complaint.

>> As it is now, you have to download the zip file and then you have to
>> remember to scan it manually, which is something most users are not
>> going to do.

>They should, however. Unless they are willing to put some effort into
>protecting themselves, they will inevitably run into trouble someday.

It is we who ultimately pay the price. Just look at all the twits that
allowed their machines to become infected with a trojan which the
hackers can use to mount DoS attacks. They have become so bold that
they are demanding extortion from website owners.

>> Then you have to unzip it and extract it to a directory before CA AV
>> detects it, and then CA AV does nothing about it. You end up with the
>> virus on your disk.

>Yes - but it's an inactive virus.

I was not talking about eicar. I was talking about viruses in general.

I'm somewhat surprised that CA does
>not scan .zip files. I'm pretty sure the on-demand scanner can be
>configured to do so; if the on-access scanner doesn't, then it's
>probably for performance reasons. But, again, I'm not familiar with CA.

Of course the on-demand scanner scans it - that's what "on demand"
means. Regardless of performance reasons, CA AV should give the user
an option to scan on-access anything that he wants. After all, how
many ZIP files do people download in a typical day.

>> If your unzip utility automatically executes the
>> file after you acknowledge its detection by CA AV,

>Automatic execution is never a good thing from a security point of view.

Yet most people do not turn it off. I installed the latest version of
Mozilla and the default settings over-rode my earlier setting and all
of a sudden it was auto-executing things. I immediately fixed it. Most
people would not have the understanding to do that.
 >> Stay informed about: Is CA EZ Antivirus any good? 

Bob a écrit :

>>Yes - but it's an inactive virus.
>
> I was not talking about eicar. I was talking about viruses in general.

I wasn't talking about Eicar either.

All viruses are inactive after they have been unzipped. They must then
be launched somehow in order to become active.

> Of course the on-demand scanner scans it - that's what "on demand"
> means. Regardless of performance reasons, CA AV should give the user
> an option to scan on-access anything that he wants. After all, how
> many ZIP files do people download in a typical day.

If you value the ability of an on-access scanner to scan zip files and
if that is why you are complaining, then I suggest you switch to a
competing product that offers the functionality you want to have and
perhaps suggest to the producer of CA that such functionality be added
in future versions. I don't see what else you could do.

>>Automatic execution is never a good thing from a security point of view.
>
> Yet most people do not turn it off.

True - but then again, people must be educated. Relying on virus
scanners to compensate for security holes or improper configuration will
not always work.
 >> Stay informed about: Is CA EZ Antivirus any good? 

Bob wrote:
[snip]
> eicar.com is 68 bytes. eicar.com.zip is 184 bytes. Why did Mozilla
> decide to preload the one and not the other?

mozilla didn't differentiate but your anti-virus may have...

> Or did it preload the zip file but CA AV did not look inside to see if
> there was a virus?
>
> You do not have to unzip a zip file to see its contents.

*something* has to perform the unzip process in order to see the
contents, even if it is only performed in memory...

--
"they threw a rope around yer neck to watch you dance the jig of death
then left ya for the starvin' crows, hoverin' like hungry whores
one flew down plucked out yer eye, the other he had in his sights
ya snarled at him, said leave me be - i need the bugger so i can see"
 >> Stay informed about: Is CA EZ Antivirus any good? 

Bob wrote:
[snip]
> As it is now, you have to download the zip file and then you have to
> remember to scan it manually, which is something most users are not
> going to do.

no, you do not have to do that... when you decompress the file manually
the contents will get scanned automatically by the on-access scanner...

> Then you have to unzip it and extract it to a directory before CA AV
> detects it, and then CA AV does nothing about it. You end up with the
> virus on your disk. If your unzip utility automatically executes the
> file after you acknowledge its detection by CA AV, then you will have
> infected your computer.

if your av detects a virus in the file it will prevent you from
accessing the file (you can't execute it, you may not even be able to
save the decompressed contents to disk)...

--
"they threw a rope around yer neck to watch you dance the jig of death
then left ya for the starvin' crows, hoverin' like hungry whores
one flew down plucked out yer eye, the other he had in his sights
ya snarled at him, said leave me be - i need the bugger so i can see"
 >> Stay informed about: Is CA EZ Antivirus any good? 

Bob wrote:
[snip]
> Of course the on-demand scanner scans it - that's what "on demand"
> means. Regardless of performance reasons, CA AV should give the user
> an option to scan on-access anything that he wants. After all, how
> many ZIP files do people download in a typical day.

better still - how many zip files does a person access without
decompressing?

the contents of a zip file are not dangerous until you extract them,
therefore they do not need to be scanned by an on-access scanner until
that point... on-access scanning is a potentially expensive process, if
you throw in automatic in-memory decompression of compressed archives in
the mix then that potential can become reality quite easily... people
will not use an on-access scanner that slows their system to a crawl...

> Yet most people do not turn it off. I installed the latest version of
> Mozilla and the default settings over-rode my earlier setting and all
> of a sudden it was auto-executing things. I immediately fixed it. Most
> people would not have the understanding to do that.

i've been using mozilla for years... i've never seen it auto-execute
anything...

--
"they threw a rope around yer neck to watch you dance the jig of death
then left ya for the starvin' crows, hoverin' like hungry whores
one flew down plucked out yer eye, the other he had in his sights
ya snarled at him, said leave me be - i need the bugger so i can see"
 >> Stay informed about: Is CA EZ Antivirus any good? 

On Fri, 03 Jun 2005 19:00:49 +0200, Frederic Bonroy
<bidonavirus RemoveThis @yahoo.fr> wrote:

>people must be educated.

Won't happen.
 >> Stay informed about: Is CA EZ Antivirus any good? 

Bob wrote:
> On Fri, 03 Jun 2005 19:00:49 +0200, Frederic Bonroy
> <bidonavirus.RemoveThis@yahoo.fr> wrote:
>
>>people must be educated.
>
> Won't happen.

ok, give me your name, address, telephone number and credit card
number... i want to show you something...

what's that you say? you're not dumb enough to do that? well how could
that have happened without becoming educated?

--
"they threw a rope around yer neck to watch you dance the jig of death
then left ya for the starvin' crows, hoverin' like hungry whores
one flew down plucked out yer eye, the other he had in his sights
ya snarled at him, said leave me be - i need the bugger so i can see"
 >> Stay informed about: Is CA EZ Antivirus any good? 

On Fri, 03 Jun 2005 22:16:25 -0400, kurt wismer <kurtw RemoveThis @sympatico.ca>
wrote:

>the contents of a zip file are not dangerous until you extract them,
>therefore they do not need to be scanned by an on-access scanner until
>that point

You make a very good point.

I am not going to be concerned about CA AV not warning me in advance.
 >> Stay informed about: Is CA EZ Antivirus any good?