It appears that Norton has dropped a load of advertising cash into Yahoo! coffers for the special privilege of being the recommending antivirus for Messenger. In the end it is only advertising and not any added functionality over any standard antivirus package. The only difference that I can see is that Yahoo! added a special API that Norton can use to scan a file before it actually hits the file system. As you will see it does not help catch viruses, it only moves the scanning phase to a different level in the file creation process.
All antivirus and firewall programs work by hooking a select few Windows API functions. In the case of antivirus programs they are most concerned with the functions used by Windows to create or move a file. What a hook does is basically add functionality to a function call by injecting extra code. Microsoft provides this “feature” out of the box even if it is not usually condoned or documented very well. When a file is transferred through Messenger it is usually kept in a memory buffer until the transfer is complete. At this time Messenger creates a file on the file system and writes the contents of the memory buffer to disk. To make this file a particular Windows API is called by the OS and if an antivirus is running the hook will also be executed. As you can see no matter how the file gets on to your system, a program will always have to use the create file API and subsequently scan the file for viruses.
This new miraculous new feature may actually be scanning the memory buffer before it is written to disk but I am only guessing. Even if it scans the memory, you are not getting any benefit from using this method and in some cases it may even be slower. So fear not my fellow Messenger user you are still safe even if you are not using Norton Antivirus.
