avast did not detect an eicar file

MWassef · 2006-08-17T18:04:53.000Z

I modified an eicar.txt file as follows:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+HX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

I saved it as .com file and ran it and it ran just fine :o :o
avast did not recognize it at all… (file attached just remove the .txt).
guys would you fix this problem ASAP…

:

igor0 · 2006-08-17T18:10:43.000Z

Problem? On contrary - if avast! detected such a modified file, then it would be a problem!
By modifying the eicar test file, you rendered it invalid - so it’s correct that it’s not detected.

RejZoR · 2006-08-17T18:17:02.000Z

Yup, read the description page for EICAR…

Vlk · 2006-08-17T18:18:30.000Z

Please see the EICAR specification here: http://www.eicar.org/anti_virus_test_file.htm

Excerpt:
The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters allowed are the space character, tab, LF, CR, CTRL-Z. To keep things simple the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the test file is that the third character is the capital letter “O”, not the digit zero.

Detecting eicar variants has traditionally been very BAD for AV programs. This is because there were some viruses that actually contained the Eicar signature, so the AV was reporting the file as infected by EICAR instead of the real virus. And of course, (even computer-security knowledgable) people usually ignore eicar alerts…

Cheers
Vlk

MWassef · 2006-08-17T18:51:32.000Z

I got it guys, thanx for the info ;D
BTW, what’s this US flag Vlk? ???

RejZoR · 2006-08-17T20:22:08.000Z

He’s probably still in the US…

igor0 · 2006-08-18T08:44:50.000Z

He’s not, he just forgot to set the flag back

Announcements