I put a eicar test file in a zipped file
i select provider (residen protection ) zipped file
i click on the zipped file and nothing!!!
avast doesn’t scream why?
What exactly does it mean that you “clicked on the zipped file”?
What are your resident protection settings?
well, if you right click on the zip file (explorer) and choose > scan, AVAST should warn you.
If you only opened the zip file, and didn’t excecute Eicar file, than AVAST resident provider will not detect it.
If you launch the Eicar file, AVAST will warn you.
The resident protection only works on executed (running)programs, this means it uses no memory scan.
I hope this is a answer to your question.
Waldo
i started the shiel provider
and i edit it
and under archives
i select zip archive
i click on the test.zip and i doesn’t scream
i have to click on the eicar.com(into the zip) to make avast scream
Do you have the .zip extension configured to be scanned on open? (second page of the standard shield configuration) - by default only .wsh files are scanned on open, if i remember correctly.
well, thats what i tried to explain you in my previous answer > it only scans executed files, that is :pressing eicar.com
But when you should right click on the .zip file, the Avquick is excetuded, that will detect
the Eicar file inside the packer.
Waldo
yah right igor thanks
Waldo: Scanning executed files is the most important, of course - but it can do much more: scan on opening (i.e. when you try to read it), scan on modification (when it’s created/written) etc. Of course, the more scanning you set, the more it will slow down your computer (even more when you turn on the archives scanning). It’s up to you what settings you prefer…
In any case, the “executed files scan” should catch the virus even when everything else is disabled (of course, the “executed files scan” has to be enabled :))