Virus under https

Do avast! scan the files that come from SSL websites?

Virus makers can host her malwares under google code to obtain a “https” url and avast do not scan these files.

Example:

Eicar.com is a anti-malware test file

HTTP downloads:
http://www.eicar.org/download/eicar.com
http://www.eicar.org/download/eicar.com.txt
http://www.eicar.org/download/eicarcom2.zip

HTTPS downloads:
https://eicar.googlecode.com/files/eicar.com
https://eicar.googlecode.com/files/eicar.com.txt
https://eicar.googlecode.com/files/eicar_com.zip

Sorry of my bad english.

Do avast! scan the files that come from SSL websites?
no, that is the point with SSL it is a secure connection......

but you are not the first to ask, here it is explained

You can't. That's not how HTTPS proxies work.

When you make an HTTPS request through a proxy, you send the proxy the CONNECT verb (not GET) and the target DNS name and port. The proxy then connects to that host and port, and forwards traffic in both directions. Your browser then negotiates the SSL tunnel directly with the target server (via the proxy, but without it doing any processing). The proxy does not get a chance to look at the plaintext data, because it never sees the plaintext data (all it sees is the SSL session setup, and then a bunch of encrypted data) – so it can never scan the data.

The only way you would be able to scan the files is if you had the proxy perform a man-in-the-middle attack on the SSL session (pretend to be the target endpoint to the client, and then make another connection to the real endpoint, then decrypt the data from the one side before re-encrypting it to send over the other side). The problem with that method is that your proxy does not have a trusted certificate that’s valid for all hostnames that the browser will try to connect to, so your users will get certificate warnings. (And in fact, that’s why browsers do the hostname check: to prevent man-in-the-middle attacks like this. Preventing this kind of attack is also why users should never ignore these warnings. The entire point of HTTPS is that you get an end-to-end encrypted channel; no other machine anywhere can see the data that’s being sent.)

But when I open a file avast! should scan it before it is opened.

Ex: The txt file

A .txt file by default isn’t scanned before you open it because it isn’t an executable file, so doesn’t present a risk. Also Open is distinctly different to Run, and you can’t Run a .txt file.

If you want non-executable/risk files to be scanned then you can adjust the avast File System Shield, Expert Settings, to scan All Files, with the usual warning about potential system performance hit.

No alerts on eicar.com.txt on download or opening in editpad lite - by renaming the eicar.com.txt and trying to open it cause avast to alert, see images.