The most explanation is that eicar.com and eicar.com.txt are not executing even if Notepad opens up or you move the file to another location… I may be wrong though.
I’ve requested to the Avast team to create a test file for the File Shield to ensure it’s working properly.
@ dcop7
You could try adding the COM to the custom settings mentioned in Vlk’s quoted post.
Look in the avastUI > Settings > Components > file system shield (FSS) > settings > Scan when Opening and Scan when writing sections.
Enable the “Scan files with custom extensions”. Now add ‘com’ without the ’ 's as I don’t believe it needs to be .com (only ‘com’). Test it to see if it works as expected.
The scan when writing should alert when the file is downloaded (written) to your hard disk (you would have to disable the web shield first.
Next the FSS should alert when you try to execute it, but you may find you can’t if it alerted when written, depends on your ‘Actions’ settings - I have mine set to Ask as the first option and No Action as the second option. The file should remain in place and awaiting your choice.
It didn’t work. I don’t have any alert. I’ve also selected to scan all files and still it didn’t worked. It downloaded correctly and I tried to run and it tries to execute the file.
.com is a old ms-dos executable type file, i dont think it will trigger a run comand in 64bit os
It seems this was already posted in a quote above, see the quote in reply #18
If you have a 64bit OS (which I assume but don't know), then there's no "execute" of the eicar test file (because it's a "COM", old 16bit code and 64bit OSes doesn't have the 16bit subsystem) - so eicar cannot be detected on execution on 64bit OSes. (So Eicar is not very useful as a test file these days.)
But in the same quote there is an exception.
However, if you are able e.g. to copy an eicar.com file from one folder into another without any detection, then there's something wrong here (just to be sure, I'd disable the "Optimize scanning during file copy option" in File System Shield Settings / Advanced).
This “Optimize scanning during file copy option” in File System Shield Settings / Advanced option is still in avast 12.3.2280 but it isn’t in avast 17.3.2291.
So the whole thing is a bit of a bloody mess.
Yeah… Not even copying a file a scan is made… Where is the real time protection?
In all honesty the eicar test isn’t about security, it has no bearing on real life protection, it is an artificial test to trigger an alert to indicate that your AV is running.
And if no alert is triggered? Doesn’t that mean it’s not working correctly?
Yes, it is true. But since the manual scan detects it, why not the real time projection?
I think that you have had your answer in the two quotes by Vlk and igor posted by NON.
The manual scan is essentially the highest level of scan, it scans everything even files/stuff that presents no risk at all.
@dcop7
It seems eicar no longer works as a test virus with latest Avast File System Sheild. On my computer eicar does not trigger any on-access detection of File System Shield, neither.
If you want to test FSS now, try “Hikaru.exe”; this is a joke exe, which displays scary girl’s face with loud screaming voice (so make sure to kill it if you run it ;D).
As Joke exes are considered as PUP, you have to enable PUP detection from File System Shield Settings → Sensitivity.
Download (sorry this is Japanese page):
http://www.vector.co.jp/download/file/win95/amuse/fh217070.html