Hello everybody,
I work at Symantec and in the past I have worked on the team that builds our HTTP or Web scanning engines. I just wanted to clear up some confusion about whether or not Norton products have Web scanning engines.
The short answer is "yes" we do. In fact there are 5 independent engines that scan HTTP content.
1) There is the Intrusion Prevention (IPS) engine that scans for all types of HTTP based exploits. The engine has many 100s of generic vulnerability signatures that dont need to change often if at all since they target the vulnerability condition which doesn't change rather than the shell-code which does. New ones are added almost weekly. The list of signatures can be found at »
www.symantec.com/avcenter/attack_sigs/. Look under "H". Every signature prefixed with "HTTP_" is being scanned on HTTP traffic. Its also important to note that the IPS engine scans ALL traffic coming into or going out of your machine, not just HTTP.
2) Browser Protection - This engine is specifically targeted at obfuscated JScript/VBScript HTTP content that exploits vulnerabilities in ActiveX, DOM or even specific data-types like VML. Highly obfuscated attacks are difficult if not impossible to reliably detect by scanning network traffic or by scanning the files in the IE cache. Hence this uses a totally different approach to the problem. But the bottom line is that it is still will block content coming over HTTP before it exploits the browser.
3) Anti-Phishing Engine - Also scans HTTP content looking for phishing page characteristics.
4) Privacy Scanning engine
5) Parental Controls.
Engines 1 and 2 are targeted at blocking malware from automatically infecting your machine when you visit an infected web page. aka drive-by downloads.
NIS/NAV doesn't scan incoming HTTP traffic for a malicious PE files (portable executable file i..e exe, com etc). We dont see the value in doing that because ultimately that file will hit the disk and when it does, our real-time scanner Auto-Protect will catch it. Hence, as some users have reported, if you try to download eicar.zip from a remote site, it wont be detected until you open the zip up and extract the eicar.com. AutoProtect will detect and block it before you can execute it.
Hope this helps.
Best,
Shane.