>Do you really think any of the 4 pages are redundant?
YES, because Page 2 doesn’t scan all of the reported extensions,
but ONLY the executable (exe,com,cmd,dll,bin) are scanned (as other AV having only one page !).
Do you really scan on open EICAR.htlm and the other extensions !!!
Page 3, of course, often stops the process…could be used seldom…
Page 4 I’ve tried…but I was not be able to exclude any scan…(may be my fault ,but it would be easy…) .
The Page Fault are below…module unknown in c15c:1b10edbd…
Data 06/29/2003 Ora 20:30
ASHSIMPL ha provocato un errore di pagina non valida nel
modulo in c15c:1b10edbd.
Registri:
EAX=040eff88 CS=016f EIP=1b10edbd EFLGS=00010246
EBX=040eff88 SS=0177 ESP=03ff0100 EBP=03ff0120
ECX=03ff01a4 DS=0177 ESI=81a5a394 FS=1c17
EDX=bff6682d ES=0177 EDI=03ff01cc GS=0000
Byte all’indirizzo CS:EIP:
Page 2 scans what it is set to scan - if not, it’s a bug, but not a trick to “impress the user”.
I have just checked and it works correctly for me (with one exception - if the file does not have any extension, then it is not scanned - that is a bug).
When I set Scan files on open and write HT* into the “Scan files with these extensions”, eicar.html is detected when I try to access it (e.g. open it in Notepad, in Internet Explorer, view by Total Commander Lister, …).
If I’m even more paranoid and write just * (i.e. an asterisk) into the “Scan files with these extensions”, again, the eicar file is detected, no matter what extension it has (except for that “no-extension” problem I noted above).
On the other hand, if I leave the “Scan files with these extensions” empty, it doesn’t scan anything on open (not even .COM) - so it works exactly as I would expect it to.
I don’t understand how is it possible that for you, it scans only executable files - there’s no such setting for “Scan files on open”.
Now, let’s try “Scan created/modified files”. I turn it on and check “Default extension set” (using the “Show…” link I verify that HT* is inside the default set, i.e. HTML files will be scanned).
Now, I start Notepad and create a new file e.htm; I paste the eicar string into the window and save the file; at that moment, I get a eicar-virus warning. Again, as I expected.
What are your exact settings on the second page in the moment EICAR.html is not detected? (and how are you working with the file?)
I’ve tried again…and still doesn’t work.
Of course I have all of those extensions typed in
the “scan open files” box . In the "scan/created-modif " there are the DEFAULT ( you know,there are so many extensions). I have nothing more to say…
Could you please copy & paste the content of your “Scan files with these extensions” box here?
How are you accessing the file (eicar.html, for example) - are you doubleclicking on it (i.e. starting the Internet Explorer) or something else?
Also, just for sure - do you have the latest build (235) of avast?
I have level 235.Below the copy/paste (I had added “HTLM” one more time !). The “scan created-modified files” has the its DEFAULT !!!
I open notepad and load eicar.htlm >>>>
and the virus is loaded.
Then I save it as eicar.htm >>>> and it is saved .
COM,EXE,DLL,HTLM,SYS,SCR,OV?,VXD,BIN,CMD,HT?,VB?,WS?,BAT
Well, the only strange thing I see is the HTLM extension (did you mean HTML or is it on purpose a different extension?). Then, I would rather use HT* instead of HT?, to catch both HTM and HTML.
But if you do it exactly as written… HTLM in the box, loading the “infected” eicar.htlm should trigger the alarm.
If you scan the file from avast window (thorough scan) - does it detect it?
Maybe one thought: since htlm is unknown to Notepad… isn’t it htlm.txt in fact (and .txt not showing)?
I did a very stupid thing !!!
I misplaced HTLM for HTML in the extension of the
file…so EICAR.htlm instead of EICAR.html !!!
SORRY,I have to pay to you a coffe !!!
REGARDS,Rolando.
ps- also if the wrong ext. had to match with HT* in the box.
They are folder scan Standard . The folder is EICARFOLDER with the same 3 virus files .
If you see in the preceding post ( I will type an “?” on it ) the scan (in my opinion)
has not been performed but Avast! says "no virus " and give a wrong number of files !
Below there is the scan of the hard drive (the file eicar.html is not find as virus file !),
and other folder scans correct.
The behaviour of Resident Shield is still worst with iecar.html . Now it is working fine .
Regards,rolando.
