Eicar test fails on Avast Free

[NON]

@Guilap post:19

Unfortunately, the eicar test is the only one I know it’s safe to try :-\ If I were to test with real infected files, I should do it in a controlled environment.

How about “Hikaru” (a Joke software) ;D
http://www.virustotal.com/file-scan/report.html?id=3c13e6169994f9e5eab10642200b5e91457b93676c73e1695caee530623d4f0b-1277110749

Download:
http://www.vector.co.jp/download/file/win95/amuse/fh217070.html

A few minutes after executing, screaming women’s voice / women’s face appears. Reboot or kill the process via TaskManager fixes this.
Win32:Hikaru is a PUP detection, so you have to enable PUP option.

[system]

Same as me.But you should try another method to test Avast! detect this virus(Refer to 13thSlayer’s post.http://forum.avast.com/index.php?topic=63733.msg538709#msg538709

[system]

Same as me.But you should try another method to test Avast! to detect this.(Refer to 13thslayer’s post.)http://forum.avast.com/index.php?topic=63733.msg538709#msg538709

[system]

@Vladimyr post:20

Out of interest, I also have XP SP3 on 7 PCs and AIS/APro stops ‘eicar.com’ on each as indicated.

Yes, yours are the exact screens I get, but only if I add com files as custom extensions on “Scan when opening”. Maybe this is a bug present only on Avast Free. Anyway, even when Avast blocks it, I miss the warning screen.

Thank you all for the suggestions of Spycar and Hikaru, they where the missing win32 eicar ;D All of them got blocked and removed when they were already in the filesystem (but, again, no warning screen).

@yongsua post:23

Same as me.But you should try another method to test Avast! to detect this.(Refer to 13thslayer’s post.)http://forum.avast.com/index.php?topic=63733.msg538709#msg538709

I believe every method should by valid. What if the infected file was on a USB stick that was already inserted when I booted?

[system]

@Guilap post:24

What if the infected file was on a USB stick that was already inserted when I booted?

Then you need something to disable autorun.inf in your machine and USB/flash drives like Panda USB Vaccine:
http://www.pandasecurity.com/homeusers/downloads/usbvaccine/. It gives you the option to “vaccine” your machine, which means it disables autoruns.inf, but with a simple click, you can enable it again. And you can vaccinate any removable drive including USB sticks. It does not conflict with Avast as I’ve been using it with no problems.

There are other companies as well: Flash_Disinfector.exe by sUBs: http://experi3nc3.wordpress.com/2007/05/10/flash-disinfector-by-subs/, AutoRun Eater http://www.softpedia.com/get/Security/Secure-cleaning/Autorun-Eater.shtml.

[NON]

@Guilap post:24

All of them got blocked and removed when they were already in the filesystem (but, again, no warning screen).

Is “SILENT/GAMING MODE” disabled?

Try to uncheck Settings → Silent/Gaming mode → Silent if a full-screen application is running.
(Just in case, avoid mis-recognized as full-screen)

[system]

Thank you for the tips, SafeSurf!

@NON post:26

Try to uncheck Settings → Silent/Gaming mode → Silent if a full-screen application is running.

You’re right, I forgot that. Running a file from desktop counts as full-screen. Worked as expected for spycar and hikaru files.

But no matter if this setting is unchecked or not or if I try to run from desktop or cmd window, trying to run eicar.com never triggers a warning (even when Avast blocks and deletes it).