Eicar test fails on Avast Free

[system]

Pause Avast

Create eicar.com with notepad, by pasting (file should be 68 bytes)
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Enable Avast
Run cmd.exe, go to eicar folder, type eicar.com

Eicar runs! Why is that?

You can try copying the file around also, but nothing happens (no warning, no copying, nor deleting the original file)

Did the exact same test on Avira free (in which is possible to pause on access scanning) and got an warning when trying to run eicar.com on command prompt

There’s definitely something wrong here :-\

Avast 5.0.677
Virus Definitions 100921-0

Win XP SP3

[igor0]

Well, it’s certainly not right - but it’s also not how avast! behaves on other computers.
Did you fully uninstall Avira before doing this, for example?

[system]

I don’t see this problem.

avast! alerts on eicar whether it is run from the commmand prompt or just double clicking it.

Have you changed any settings within avast?

[system]

Thanks for the replies!

Only Avast was running when I did this tests. I uninstalled all antivirus software and installed a clean Avast Free (unless it remembers previous settings, but I don’t remember messing the settings before).

Now, I’ve just booted the PC, waited for everything to be started, and I was able to run eicar.com (in my desktop) with no warnings.

Then I decided to check the settings. File System Shield options were:

• “Scan when executing” screen: all checked
• “Scan when opening” screen: just “Scan Documents when opening” checked

Now, if I check “Scan all files” in the last screen, voilà: I receive an warning from Avast and eicar.com doesn’t run. But if I disable this option, I can run eicar.com again (I left half a dozen in my desktop for testing).

Is this the expected Avast free behaviour? It appears Avast free thinks eicar.com is a document, not a program (and a document type it shouldn’t verify). What are the default settings?

[igor0]

No, a .COM file is certainly not considered a document.
Can you post a screenshot of the popup when it was detected?

[system]

Here you go! (remember, it only appears with “Scan all files” checked)

[igor0]

How about exclusions - do you have any set?

[system]

can’t really test that here, downloading the eicar file with fdm gives an Avast file system shield alert (and no need to turn on the “all files” setting), but turning the shields off, and downloading eicar.com, then run it from the command prompt or just clicking on it is a no go as it’s not recognized a valid extension on 64 bit Windows.

[system]

This may be completely unrelated but I’ll mention it anyways:
I went and tried out the eicar.com test (I’d never heard of it)
After double-clicking the file, avast! moved it to the virus chest.
I restored the file, clicked it again, same thing.
After restoring and running a third time, avast! and the command prompt kinda formed some sort of endless loop.
The command prompt will not go away, no matter what I do, and I cannot move the file to the chest or delete it.
If I clicked move to chest or delete, the threat warning would pop up again and again.
Though selecting block worked.

[system]

Just these (attached)

[system]

When I try this, without ‘Scan All files’ checked, I get an alert on the eicar file, but with the process ntvdm.exe (the Windows NT Virtual DOS Machine, the exectuable that runs 16 bit programs: http://en.wikipedia.org/wiki/Virtual_DOS_machine)

Possibly something relating to XP? (im using Vista for this)

[NON]

Issue partially confirmed :-\

Once eicar.com is successfully created (with avast disabled), I don’t have any alert when executing eicar.com.
However, when I copy eicar.com to other place, alert appears.

I don’t check “Scan all files”.

P.S. tested on Win7 32bit.

[Vlk]

Yep. That’s because

• COM is not scanned on-open by default
• the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Thanks
Vlk

[NON]

@Vlk post:13

Yep. That’s because

• COM is not scanned on-open by default
• the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Thanks
Vlk

Alert appears, working confirmed.

Off topic: it seems we should have new “eicar”, which is native Win32 binary

[system]

@Vlk

You can add COM to the list of custom files in the “Scan when opening” section, this should help.

Did that. Then if I try to run eicar.com from cmd window I receive “Access is denied” and eicar is deleted. If I try running eicar from the desktop, the eicar file simply disappears. Either case there are no warning messages from Avast (though it is shown in shield traffic screen as the “last file infected”).

Ok, eicar.com prevented from running, but it feels somewhat strange…

- COM is not scanned on-open by default - the execution of COM files is somewhat special (not really execution in the classical sense of Windows).

But don’t you think this could be exploited by an attacker? I mean, if you somehow manage to create a .com file in the target computer’s filesystem, you could run malicious code without any warning from Avast. (as long as it is a 32-bit OS)

[DavidR]

.com files because of their nature (basically exe files) should be scanned as part of the avast default file set.

[Vlk]

If it were a normal (Windows) executable it would get scanned on-exec not matter what the filename extension is.
The problem is caused by the fact that Eicar is not a Windows executable file.

[Lisandro]

@Vlk post:17

The problem is caused by the fact that Eicar is not a Windows executable file.

Why don’t you develop a always-block-eicar-test system to let the users calm down and trust avast: ;D
I mean, a placebo-proof antivirus

[system]

Unfortunately, the eicar test is the only one I know it’s safe to try :-\ If I were to test with real infected files, I should do it in a controlled environment.

Besides that, Avira free passed this exact same test.

@http://www.eicar.org/anti_virus_test_file.htm

A third set of requests [for viruses] come from exactly the people you might think would be least likely to want viruses: “users of anti-virus software”.

They want some way of checking that they have deployed their software correctly, or of deliberately generating a “virus incident in order to test their corporate procedures, or of showing others in the organisation what they would see if they were hit by a virus”.

(…)

Using real viruses for testing in the real world is rather like setting fire to the dustbin in your office to see whether the smoke detector is working. Such a test will give meaningful results, but with unappealing, unacceptable risks.

[Vladimyr]

@Guilap post:19

Unfortunately, the eicar test is the only one I know it’s safe to try :-\ If I were to test with real infected files, I should do it in a controlled environment.

Spycar will try to do real "damage’ (and repair it with ‘Tow Truck’ if necesary).

Out of interest, I also have XP SP3 on 7 PCs and AIS/APro stops ‘eicar.com’ on each as indicated.