eicar over ssl

system · 2015-09-23T09:57:30.000Z

Exactly the same is happening at my end, gj_sp.

If I turn on ‘Block malware URLs’ in ‘Web Shield’, the following screenshot will pop up and the website will be blocked, i.e. the URL has been blacklisted.
If I turn off ‘Block malware URLs’ in ‘Web Shield’, Avast will do nothing to stop it, i.e. ‘eicar.com’ can be successfully downloaded, saved and run.

My worry is that, if a real virus is on a site whose URL has not been blacklisted, will Avast allow downloading it when ‘Block malware URLs’ has been turned off?

By the way, gj_sp, can you change your user interface language to English, so that we can understand your screenshots? I have changed mine from Chinese into English.

system · 2015-09-23T11:09:58.000Z

Yes, it’s my concern too. Of course I can change it, but I hope the important part of the screenshot is understandable.

system · 2015-09-23T11:13:15.000Z

I don’t understand your second screenshot.

system · 2015-09-23T11:31:34.000Z

Oh, sorry, I double clicked on eicar.com, and Windows asked me whether I want to run it or not. Just wanted to show that Avast did nothing.

system · 2015-09-23T11:47:00.000Z

I am worrying that Avast will still do nothing when it is a real virus.

system · 2015-09-23T12:05:06.000Z

Me too.

igor0 · 2015-09-23T14:16:40.000Z

What operating system do you have - 32bit or 64bit?

essexboy · 2015-09-23T14:26:36.000Z

The link posted goes direct to the eicar.com file so it will be blocked by webshield
The main Eicar page can be accessed but the minute you try to download any of the files you get blocked as is to be expected

Pondus · 2015-09-23T14:41:20.000Z

Eicar website http://www.eicar.org/ (should not be blocked)

Eicar website with files info http://www.eicar.org/85-0-Download.html (should not be blocked)

Direct download links using the standard protocol http

eicar.com http://www.eicar.org/download/eicar.com
eicar.com.txt http://www.eicar.org/download/eicar.com.txt
eicar_com.zip http://www.eicar.org/download/eicar_com.zip
eicarcom2.zip http://www.eicar.org/download/eicarcom2.zip

Direct download links using the secure, SSL enabled protocol https

eicar.com https://secure.eicar.org/eicar.com
eicar.com.txt https://secure.eicar.org/eicar.com.txt
eicar_com.zip https://secure.eicar.org/eicar_com.zip
eicarcom2.zip https://secure.eicar.org/eicarcom2.zip

system · 2015-09-23T14:50:07.000Z

igor post:43:

What operating system do you have - 32bit or 64bit?

Mine is 64bit.

When I have turned off ‘Block malware URLs’ in ‘Web Shield’, ‘File System Shield’ will do nothing to block ‘eicar.com’, which can thus be downloaded, saved and run.

Is it acceptable?

Pondus · 2015-09-23T15:04:04.000Z

after you have saved it … if you right click on it and scan, what happens then?

system · 2015-09-23T15:05:01.000Z

It can detect a threat. See https://forum.avast.com/index.php?topic=176722.msg1253178#msg1253178

Pondus · 2015-09-23T15:10:45.000Z

i think that is correct as it is just a txt string, i dont think .com file (MS-DOS) run on Win10

will see when Igor is back with a reply

igor0 · 2015-09-23T15:22:12.000Z

Yes, Eicar isn’t detected “on execution” (i.e. when you doubleclick on it) on 64bit operating systems because it’s a DOS COM file and there isn’t any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn’t called to scan the file and the file isn’t detected (Windows just gives you an error that the file cannot be started).

That’s as expected and it’s nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn’t mean that Avast isn’t scanning for viruses (those that actually can be started).

gatocan2066 · 2015-09-23T15:32:50.000Z

Well now works on https eicar as always, he was wrong not perhaps some correcion of virus databases. ;D ;D ;D

tested on my 2 pc with Avast Free 10/04/2233

system · 2015-09-23T15:34:54.000Z

Is there a test virus that can run on 64-bit Windows, which is becoming common nowadays?

igor0 · 2015-09-23T15:48:12.000Z

I’m not aware of any.

system · 2015-09-23T17:13:31.000Z

Mine is 64 bit too.

1234ava · 2015-09-23T22:26:37.000Z

igor post:50:

Yes, Eicar isn’t detected “on execution” (i.e. when you doubleclick on it) on 64bit operating systems because it’s a DOS COM file and there isn’t any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn’t called to scan the file and the file isn’t detected (Windows just gives you an error that the file cannot be started).

That’s as expected and it’s nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn’t mean that Avast isn’t scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?

bob3160 · 2015-09-24T01:04:23.000Z

1234ava post:55:

igor post:50:

Yes, Eicar isn’t detected “on execution” (i.e. when you doubleclick on it) on 64bit operating systems because it’s a DOS COM file and there isn’t any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn’t called to scan the file and the file isn’t detected (Windows just gives you an error that the file cannot be started).

That’s as expected and it’s nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn’t mean that Avast isn’t scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?

You’re the curious one so why don’t you try it.
I think this topic has beaten itself to death. Time to end it.
All the questions on something that only required one answer have already been answered.

Announcements