Eicar test file

Hi again
Shouldnt the eicar test file be nuked at once by the resident scanner. ???
Im allowed to download it to the desktop, and only when i open it, Avast comes to life.
But its okay too i guess, as long it nicks the bad boys before they run.
Isnt that correct?
Regds.
Omik

I do not use the Resident Protection from Avast, but if i remembere correctly you can change the behave of the scanner in the settings.

raman is right, you can just change the settings of the resident protection.

You can either set the protection level to High, or fine-tune the settings by changing individual properties of the “Standard Shield”. To access these settings, click on the a-ball icon, push the ‘Details’ button and double click on Standard Shield icon.

Hope this helps,
Vlk

Hi & THX for your answere.
But my concern was, shouldnt the eicar file be stopped at once, and not be allowed to download to the desktop.
I run the resident shield on high.
Regds.
Omik :slight_smile:

Hey, you run it on high? In this case, it should have been stopped… >:(
Were you running it on high when you were performing the test??

Anyway, what OS are you using?

Vlk

Hi vlk.
Im running Win Me.
The resident shield was on high when i did the test.
Regds.
Omik :slight_smile:

Too bad :(.

I’ll tell our QA guys to test it (and if it shows up, fix it!) - on Monday!

Thanks
Vlk

Thx Vlk.
I cant be the only one then.
Havent any of the others mentioned it before.?
Anyway , Avast does get it when i open the file, so it does work, in a non resident way ;D ;D, if one can use these words.
We will see on monday.
Regds.
Omik

Vlk.
Just to let you know.
Tried uninstall & reinstall.
Still the same.
Now this is the harmless eicar test virus, but i trust that the resident shield will nick a real virus.
I can see its working, and see the number of files its checked, so there seems to be no probs.
Just wont detect that … eicar virus ;D
Regds.
Omik

Hi Vlk.
Just curious.
Any news from the tech guys.
Omik :slight_smile:

It was really a bug. Has been fixed today. It only affects Win9x-based machines. The fix will be included in the next update… :wink:

Thanks for hammering this bug down,
Vlk

Hi Vlk.
Great 8)
Glad you found out & and thanks for your quick action on this issue :smiley: :smiley:
Regards
Omik

When will the new program build come out? :slight_smile:

Hey Omik,

I know I come in on this late, but want to comment.
The Eicar virus test is designed to test the ability of an anti-virus to protect your system from embedded viruses that infect a system when OPENED… hence, Avast stoped it right where it is suppossed to.
If the Avast team said it was a bug and it will be fixed, I guess think that they will modify Avast to stop it at an earlier point.
I have used other anti-virus products against Eicar and they also stop it when an attempt is made to OPEN the file.

Hope this helps add something to the explanation given by the Avast team.

AVAST IS THE BEST !!!

Good luck.

Hi tec 101.
It does :slight_smile:
Regards
Omik

As I said, the expected behavior is that it is picked immediately (on download) when the resident protection level is set to High, and when executed with the level set to Normal. This is how it works under WinNT/2K/XP/2K3 with build 211, and this is how it will work under Win9x in the next update.

When will the new program build come out?

I don’t want to promise, but I’d say less then a week.

Vlk

Just came from the TrendMicro website.

Went to dl Eicar test file and Avast picked up on it immediately.

Jeeze I love this program… :smiley:

Job well done!

Just to be sure we are talking about the same thing: I went to
http://www.thepcmanwebsite.com/virus_test.shtml to check avast against Eicar test files.

I selected the first one, i.e. eicar.com and avast triggered an alarm before the file was opened: I could delete the file from my temp directory from avast and after this cancel the download operation from Mozilla.

For the second file, I could download it, save it to disk and when I tried to open it, then avast blew the siren.

With the zip files, XP automatically opens a dialog displaying the content of the archive and when trying to extract this content, then avast warns you.

As far as I’m concerned, this looks quite good to me, I don’t know how other anti-virus programs behave, but just for my own knowledge: wouldn’t it be possible to make avast behave in all cases as it does for the first file ? Just asking…

Vincent, as I said, it should be enough to switch the resident protection level from Normal to High (in a window that appears when you double-clicj the avast a-ball tray icon).

Vlk

No, my resident protection level is high, and the behavior of avast! is what I mentionned before.