« previous next »
Pages: 1 2 3 [4] 5   Go Down

Author Topic: eicar over ssl  (Read 20023 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Re: eicar over ssl
« Reply #45 on: September 23, 2015, 04:50:07 PM »
Quote from: igor on September 23, 2015, 04:16:40 PM
What operating system do you have - 32bit or 64bit?
Mine is 64bit.

When I have turned off 'Block malware URLs' in 'Web Shield', 'File System Shield' will do nothing to block 'eicar.com', which can thus be downloaded, saved and run.

Is it acceptable?
« Last Edit: September 23, 2015, 04:57:25 PM by Matthew_Wai »
Logged

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37533
  • Not a avast user
Re: eicar over ssl
« Reply #46 on: September 23, 2015, 05:04:04 PM »
after you have saved it ... if you right click on it and scan, what happens then?

Logged

REDACTED

  • Guest
Re: eicar over ssl
« Reply #47 on: September 23, 2015, 05:05:01 PM »
Logged

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37533
  • Not a avast user
Re: eicar over ssl
« Reply #48 on: September 23, 2015, 05:10:45 PM »
i think that is correct as it is just a txt string, i dont think .com file (MS-DOS) run on Win10

will see when Igor is back with a reply

Logged

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: eicar over ssl
« Reply #49 on: September 23, 2015, 05:22:12 PM »
Yes, Eicar isn't detected "on execution" (i.e. when you doubleclick on it) on 64bit operating systems because it's a DOS COM file and there isn't any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn't called to scan the file and the file isn't detected (Windows just gives you an error that the file cannot be started).

That's as expected and it's nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn't mean that Avast isn't scanning for viruses (those that actually can be started).
Logged

Offline gatocan2066

  • Jr. Member
  • **
  • Posts: 96
Re: eicar over ssl
« Reply #50 on: September 23, 2015, 05:32:50 PM »
Well now works on https eicar as always, he was wrong not perhaps some correcion of virus databases.  ;D ;D ;D

tested on my 2 pc with Avast Free 10/04/2233
Logged

REDACTED

  • Guest
Re: eicar over ssl
« Reply #51 on: September 23, 2015, 05:34:54 PM »
Is there a test virus that can run on 64-bit Windows, which is becoming common nowadays?
« Last Edit: September 23, 2015, 05:36:55 PM by Matthew_Wai »
Logged

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: eicar over ssl
« Reply #52 on: September 23, 2015, 05:48:12 PM »
I'm not aware of any.
Logged

REDACTED

  • Guest
Re: eicar over ssl
« Reply #53 on: September 23, 2015, 07:13:31 PM »
Mine is 64 bit too.
Logged

Offline 1234ava

  • Full Member
  • ***
  • Posts: 161
Re: eicar over ssl
« Reply #54 on: September 24, 2015, 12:26:37 AM »
Quote from: igor on September 23, 2015, 05:22:12 PM
Yes, Eicar isn't detected "on execution" (i.e. when you doubleclick on it) on 64bit operating systems because it's a DOS COM file and there isn't any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn't called to scan the file and the file isn't detected (Windows just gives you an error that the file cannot be started).

That's as expected and it's nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn't mean that Avast isn't scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?
Logged

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48566
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: eicar over ssl
« Reply #55 on: September 24, 2015, 03:04:23 AM »
Quote from: 1234ava on September 24, 2015, 12:26:37 AM
Quote from: igor on September 23, 2015, 05:22:12 PM
Yes, Eicar isn't detected "on execution" (i.e. when you doubleclick on it) on 64bit operating systems because it's a DOS COM file and there isn't any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn't called to scan the file and the file isn't detected (Windows just gives you an error that the file cannot be started).

That's as expected and it's nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn't mean that Avast isn't scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?
You're the curious one so why don't you try it.
I think this topic has beaten itself to death. Time to end it.
All the questions on something that only required one answer have already been answered. :)
Logged
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXde -  Repair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

REDACTED

  • Guest
Re: eicar over ssl
« Reply #56 on: September 24, 2015, 08:31:21 AM »
bob3160 is using 64-bit Windows, and his File System Shield blocks eicar.com.
I am also using 64-bit Windows, but my File System Shield does not block eicar.com.

Why?
Logged

Offline 1234ava

  • Full Member
  • ***
  • Posts: 161
Re: eicar over ssl
« Reply #57 on: September 24, 2015, 10:19:51 AM »
Quote from: bob3160 on September 24, 2015, 03:04:23 AM
Quote from: 1234ava on September 24, 2015, 12:26:37 AM
Quote from: igor on September 23, 2015, 05:22:12 PM
Yes, Eicar isn't detected "on execution" (i.e. when you doubleclick on it) on 64bit operating systems because it's a DOS COM file and there isn't any 16bit subsystem on 64bit Windows that would be able to execute it. So there is no execution being started, Avast isn't called to scan the file and the file isn't detected (Windows just gives you an error that the file cannot be started).

That's as expected and it's nothing to worry about. It would be detected on 32bit operating systems (because it can be started there), and it doesn't mean that Avast isn't scanning for viruses (those that actually can be started).

What if Eicar.com is run in dosbox on a 64bit Windows?
You're the curious one so why don't you try it.
[...]

Because... I was posting at 12:26:37 AM  :D

Now I've just tried, and Avast did not detect Eicar.com execution in Dosbox on my 64bit Windows.
I guess such behavior is expected, is that right Igor?

EDIT:
After a while I've noticed "Virus Found ... Process PID 4292", see screenshot below.
Perhaps, Avast does not detect execution but it detects the Dosbox process using the file anyway.


And, Avast DOES detect eicar.com when I download it.

Bob, I don't care about Eicar.com as such, but I am curious because I have some old DOS and WIN 16bit programs which I might execute  in virtual boxes sometimes.
« Last Edit: September 24, 2015, 11:15:35 AM by 1234ava »
Logged

Offline MartinZ

  • Advanced Poster
  • **
  • Posts: 1057
  • Product Manager
Re: eicar over ssl
« Reply #58 on: September 24, 2015, 01:11:25 PM »
The issue is fixed now.
Logged

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: eicar over ssl
« Reply #59 on: September 24, 2015, 02:11:08 PM »
Quote from: Matthew_Wai on September 24, 2015, 08:31:21 AM
bob3160 is using 64-bit Windows, and his File System Shield blocks eicar.com.
I am also using 64-bit Windows, but my File System Shield does not block eicar.com.

The blocking on Bob's machine was caused by the file being written to / created - that works. Just the execution doesn't as the file cannot actually be started.
Logged
Pages: 1 2 3 [4] 5   Go Up
« previous next »