eicar over ssl

Pondus · 2015-09-23T14:41:20.000Z

Eicar website http://www.eicar.org/ (should not be blocked)

Eicar website with files info http://www.eicar.org/85-0-Download.html (should not be blocked)

Direct download links using the standard protocol http

eicar.com http://www.eicar.org/download/eicar.com
eicar.com.txt http://www.eicar.org/download/eicar.com.txt
eicar_com.zip http://www.eicar.org/download/eicar_com.zip
eicarcom2.zip http://www.eicar.org/download/eicarcom2.zip

Direct download links using the secure, SSL enabled protocol https

eicar.com https://secure.eicar.org/eicar.com
eicar.com.txt https://secure.eicar.org/eicar.com.txt
eicar_com.zip https://secure.eicar.org/eicar_com.zip
eicarcom2.zip https://secure.eicar.org/eicarcom2.zip

system · 2015-09-23T14:50:07.000Z

igor post:43:

What operating system do you have - 32bit or 64bit?

Mine is 64bit.

When I have turned off ‘Block malware URLs’ in ‘Web Shield’, ‘File System Shield’ will do nothing to block ‘eicar.com’, which can thus be downloaded, saved and run.

Is it acceptable?

Pondus · 2015-09-23T15:04:04.000Z

after you have saved it … if you right click on it and scan, what happens then?

system · 2015-09-23T15:05:01.000Z

It can detect a threat. See https://forum.avast.com/index.php?topic=176722.msg1253178#msg1253178

Pondus · 2015-09-23T15:10:45.000Z

i think that is correct as it is just a txt string, i dont think .com file (MS-DOS) run on Win10

will see when Igor is back with a reply

igor0 · 2015-09-23T15:22:12.000Z

Yes, Eicar isn’t detected “on execution” (i.e. when you doubleclick on it) on 64bit operating systems because it’s a DOS COM file and there isn’t any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn’t called to scan the file and the file isn’t detected (Windows just gives you an error that the file cannot be started).

That’s as expected and it’s nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn’t mean that Avast isn’t scanning for viruses (those that actually can be started).

gatocan2066 · 2015-09-23T15:32:50.000Z

Well now works on https eicar as always, he was wrong not perhaps some correcion of virus databases. ;D ;D ;D

tested on my 2 pc with Avast Free 10/04/2233

system · 2015-09-23T15:34:54.000Z

Is there a test virus that can run on 64-bit Windows, which is becoming common nowadays?

igor0 · 2015-09-23T15:48:12.000Z

I’m not aware of any.

system · 2015-09-23T17:13:31.000Z

Mine is 64 bit too.

1234ava · 2015-09-23T22:26:37.000Z

igor post:50:

Yes, Eicar isn’t detected “on execution” (i.e. when you doubleclick on it) on 64bit operating systems because it’s a DOS COM file and there isn’t any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn’t called to scan the file and the file isn’t detected (Windows just gives you an error that the file cannot be started).

That’s as expected and it’s nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn’t mean that Avast isn’t scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?

bob3160 · 2015-09-24T01:04:23.000Z

1234ava post:55:

igor post:50:

Yes, Eicar isn’t detected “on execution” (i.e. when you doubleclick on it) on 64bit operating systems because it’s a DOS COM file and there isn’t any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn’t called to scan the file and the file isn’t detected (Windows just gives you an error that the file cannot be started).

That’s as expected and it’s nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn’t mean that Avast isn’t scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?

You’re the curious one so why don’t you try it.
I think this topic has beaten itself to death. Time to end it.
All the questions on something that only required one answer have already been answered.

system · 2015-09-24T06:31:21.000Z

bob3160 is using 64-bit Windows, and his File System Shield blocks eicar.com.
I am also using 64-bit Windows, but my File System Shield does not block eicar.com.

Why?

1234ava · 2015-09-24T08:19:51.000Z

bob3160 post:56:

1234ava post:55:

igor post:50:

Yes, Eicar isn’t detected “on execution” (i.e. when you doubleclick on it) on 64bit operating systems because it’s a DOS COM file and there isn’t any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn’t called to scan the file and the file isn’t detected (Windows just gives you an error that the file cannot be started).

That’s as expected and it’s nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn’t mean that Avast isn’t scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?

You’re the curious one so why don’t you try it.
[…]

Because… I was posting at 12:26:37 AM

Now I’ve just tried, and Avast did not detect Eicar.com execution in Dosbox on my 64bit Windows.
I guess such behavior is expected, is that right Igor?

EDIT:
After a while I’ve noticed “Virus Found … Process PID 4292”, see screenshot below.
Perhaps, Avast does not detect execution but it detects the Dosbox process using the file anyway.

And, Avast DOES detect eicar.com when I download it.

Bob, I don’t care about Eicar.com as such, but I am curious because I have some old DOS and WIN 16bit programs which I might execute in virtual boxes sometimes.

MartinZ · 2015-09-24T11:11:25.000Z

The issue is fixed now.

igor0 · 2015-09-24T12:11:08.000Z

Matthew_Wai post:57:

bob3160 is using 64-bit Windows, and his File System Shield blocks eicar.com.
I am also using 64-bit Windows, but my File System Shield does not block eicar.com.

The blocking on Bob’s machine was caused by the file being written to / created - that works. Just the execution doesn’t as the file cannot actually be started.

system · 2015-10-04T07:04:53.000Z

MartinZ post:59:

The issue is fixed now.

Now, on my 64-bit Windows, eicar.com will be blocked only by Web Shield but not by File System Shield. Can it be fixed too?

Pondus · 2015-10-04T08:14:27.000Z

https://forum.avast.com/index.php?topic=176722.msg1253934#msg1253934

system · 2015-10-04T08:24:00.000Z

Pondus post:62:

https://forum.avast.com/index.php?topic=176722.msg1253934#msg1253934

Surely, I have read the above post.
But File System Shield could block eicar.com when bob3160 clicked on https://secure.eicar.org/eicar.com
He just clicked on it but not wrote or created anything, see https://forum.avast.com/index.php?topic=176722.msg1253260#msg1253260

My File System Shield does not do the same at my end.

igor0 · 2015-10-04T09:06:42.000Z

The screenshot itself shows that the file was detected when created or modified - so it wasn’t detected when clicked on.

Announcements