Author Topic: Avast can't process Unicode-filename virus  (Read 48561 times)

0 Members and 1 Guest are viewing this topic.

PapaSmurf

  • Guest
Re: Avast can't process Unicode-filename virus
« Reply #30 on: May 27, 2008, 06:21:23 AM »
I reproduced this "problem" by doing the same thing (I think) as the original poster. I copied the text string of the eicar test into notepad, clicked 'save as' and then inserted unicode into the filename and saved it as .exe

Avast immediately popped up and recognized it and propted for action. When I told it to delete the file, it couldn't, and generated an error to this effect. I also noticed that notepad locked up. This behavior is actually expected and in no way a security risk. Allow me to explain:

When you have a file open for editing (word, excel, notepad etc), windows locks it to prevent data corruption. To test this, try opening a text file in notepad, then using windows explorer try and delete it while it is still open. It won't work. This is what you are asking Avast to do with this test. This is an operating system feature and a good one at that. When a virus tries to execute on your system, it is not opened in the same way as a text editor would open it for writing. The point here is that this 'test' doesn't really serve a useful function. The real way to test this is save the file as before, but when avast pops up, tell it to do nothing (because the file is still open for writing in notepad). Then exit out of notepad and then browse to the directory where you saved the בּ.exe or whatever. Now see how Avast handles it. If it still is unable to delete the file when the file is not locked by the OS, this is something you should report.

I hope this clears things up. Also, this is a good example of why you shouldn't act like a troll when other forum users don't give you the response you want. The conclusion here is user error/lack of knowledge.

nate@rn ty. I have to admit, I was laughing my butt off until I saw that someone finally caught on to the run time error, (windows is famous for these.), but as you point out, with out these little safeties built in, most systems would probably be trashed in the first couple of weeks. I am still laughing about this, because I do not see that the question has ever been answered..lol. So I will answer it.
My avast free edition caught it and gave me options..I chose..MOVE IT TO VAULT..hmmm..novel idea don't you think?
I like the vault option for all things because I then have the time to examine a file, decide weather or not it is a false positive, (these things do happen), and then deal with it, or just leave it locked up.
As to horinius, I think someone needs to take a chill pill..lol. But thanks for the entertainment.  ;D :D :P

solcroft

  • Guest
Re: Avast can't process Unicode-filename virus
« Reply #31 on: May 27, 2008, 08:36:34 AM »
The real way to test this is save the file as before, but when avast pops up, tell it to do nothing (because the file is still open for writing in notepad). Then exit out of notepad and then browse to the directory where you saved the בּ.exe or whatever. Now see how Avast handles it. If it still is unable to delete the file when the file is not locked by the OS, this is something you should report.
This is what I'm seeing on my end with avast! 4.8.1201, Win XP Home SP2.