'Blocking Mode' causing File Permissions Saving issue (with some MS Word file)

[paulstevens]

I  recently identified an issue with saving a couple particular MS Word files, as having a file permission issue.  The file would attempt to save, appear in my file explore folder briefly, then promptly disappear, essentially not saving the Word Document with its changes. 

This confused me for quite a while, until i was lead to test out this Word saving error with Immunet protection features disabled. Which indeed solved the issue i was experiencing.  A little experimentation toggling the various protection options in Immunet revealed that the culprit was in fact the 'Blocking Mode' option.  Once disabled the problem vanished and i was able to save my amended Word File with no further issues. 

From my understanding, this is not the intention of the Blocking Mode, but an artifact of the fact that MS word seems to 'install' a file prior to saving (which is odd as it doesnt do it for every word file, and i've only seen this issue on a couple of my Word files.  

I've attached a copy of the one of the word files that was causing the issue for me, should anyone want to reproduce the problem i was experiencing.  

Core Themes New Version Julie 6 April v8 Experiment.docx

[zombunny2]

Blocking-mode is only supposed to delay access to the file until it has been scanned (which is how virtually all other AV software works).

Disabling blocking-mode should have no effect other than increasing performance (and decreasing security) by allowing access to the file even while Immunet is still attempting to scan it.

The behaviour you experience is extremely odd. My only thought is perhaps either one of Immunet's cloud engines thinks the temp file that Word creates is a virus, or that Immunet's blocking-mode has a bug whereby Word assumes it has access to the temporary file when in fact it is being temporarily-blocked by Immunet as it's being scanned.

Does Immunet pop up with a "virus found" or "process blocked" message, or anything like that when the problem occurs? I note that none of the scanners at Jotti.org flag the file as malicious.

Seeing as Cisco staff appear to have no presence on this forum anymore, I suspect this issue will not be resolved any time soon. I think the best you can do is probably to make sure you run another AV in tandem with Immunet, and disable blocking mode. Alernatively, simply replace Immunet with another AV that's less bug-ridden and slow.