Standard Shield (on-access module) question!

[faffy]

I tried to enable zip scanning in the  Tasks -> Resident Protection -> Standard Shield -> Packers. I ticked ZIP in and downloaded the EICAR.ZIP file. No response from avast. I opened the zip file -> nothing. I unzipped the eicar.com to my desktop -> nada.  avast only reacted to the test virus when I wanted to execute the com file.  Is it supposed to behave like this? Then what's the point of the on-access scanner options?

Faffy

[RejZoR]

You need to set Standard Shield to High Sensitivity.

[faffy]

You are partially right,. If I set the Shield to High Sensitivity, avast did not let me download the com file. However, it allowed me to download the zip file even if I set the Standard Shield to High and added the zip extension to be scanned or changed the resident TASK to scan packers.

Faffy

[Lars-Erik]

I think you need to add some lines about scanning archives as well (it's not active as default in Home edition). There was a thread on this here just a few days ago.

[Culpeper]

I tried to enable zip scanning in the  Tasks -> Resident Protection -> Standard Shield -> Packers. I ticked ZIP in and downloaded the EICAR.ZIP file. No response from avast. I opened the zip file -> nothing. I unzipped the eicar.com to my desktop -> nada.  avast only reacted to the test virus when I wanted to execute the com file.  Is it supposed to behave like this? Then what's the point of the on-access scanner options?

Faffy

I think it should have thrown up an alert when you scanned the zip file.  Did you also try right clicking on the zip file name in windows explorer and select scan file  (just to scan that one file)?

[faffy]

I think you need to add some lines about scanning archives as well (it's not active as default in Home edition). There was a thread on this here just a few days ago.

I read the thread you mentioned, that's the reason I started experimenting with the Standard Shield.

[faffy]

I tried to enable zip scanning in the  Tasks -> Resident Protection -> Standard Shield -> Packers. I ticked ZIP in and downloaded the EICAR.ZIP file. No response from avast. I opened the zip file -> nothing. I unzipped the eicar.com to my desktop -> nada.  avast only reacted to the test virus when I wanted to execute the com file.  Is it supposed to behave like this? Then what's the point of the on-access scanner options?

Faffy

I think it should have thrown up an alert when you scanned the zip file.  Did you also try right clicking on the zip file name in windows explorer and select scan file  (just to scan that one file)?

Well it did not warn me at all opening a virus containing zip file.

Obviously, if I scan the file with the scanner it says that I have a virus otherwise the software would not be worth much, would it?

[Iso-G]

Hello,

The following is my old evaluation data of avast! 4.1 carried out last year.
The original is in Japanese and it was already put on my web page last year.
"Memo of a Little Experiment", Nov. 28, 2003 ~Dec. 05, 2003

I don't know the exactly behavior of the today's latest avast!, but this data may be consulted for you.

Thanks,

Iso-G

[Iso-G]

Sorry,
I missed typing.

URL is http://iso-g.hp.infoseek.co.jp/storage/en/avast_eval01en.html

[Culpeper]

I'm confused. You want Avast to know there is an infected embedded file within a zip file while it unzipps the zip file and before Avast scans the zip file?  I think Avast has the ability to scan within a zip file but I'm not sure it will prevent you from unzipping a zip file with an infected file.  I could be wrong.  I have been before and probably will in the future.  I normally scan individual zip files before opening them.

[RejZoR]

avast! extracts files into TEMP folder (these files are in encrypted form as in chest (quarantine)) and than scannes them. Anyways any virus is harmless even if its on your desktop. You just need to avoid running it (executable).

[faffy]

I am sorry I always find the argument that a virus is harmless until it is executed very weak and defensive. I have a virus protection on my machine not to have viruses on it, whether they are executed or not.  If I download a zip file from the net, I want my antivirus program to check it by default. I think it is not too much to ask, is it?

Faffy

[Culpeper]

I'm not disagreeing with you just saying I don't believe Avast will scan the inside of a zip file unless you ask it to.  I could be wrong and it might be a bug you discovered.

[faffy]

I'm not disagreeing with you just saying I don't believe Avast will scan the inside of a zip file unless you ask it to.  I could be wrong and it might be a bug you discovered.

The problem is that I asked it to scan inside zip files and yet it did not do that.

(Just a note: Bitdefender blocked the saving of all 4 eicar files by default.)

Faffy

Here is the link to the eicar files:http://www.eicar.org/anti_virus_test_file.htm

[Culpeper]

I downloaded both eicar zip files.  I was able to save them to a folder and unzip them without detection.  However, Avast detected the infected files when I scanned the "*.zip" files manually.  My Standard Shield is set to normal.