Thanks for your interest, igor.
Sorry, I was wrong when I said that I left
eicar.com resident in memory. I just avoided the window in which eicar.com was executed was closed. I thought that it was enough to leave it resident in memory because avast! detected that the memory was infected, but what avast! really detected was the registry value that I had added before. Please, forgive my ignorance.
So, I have repeated the “experiment”. I have done it in a virtual machine with a Windows 2000 SP4 with 128 MB of RAM. I have created a new value at
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to run
eicar.com at startup.
I have just realised what is the problem. If I log on quickly,
eicar.com runs (it displays “EICAR-TEST-FILE…”) and avast! cannot detect it. I suppose this happens because avast! is not completely loaded yet. But, if I wait around 30 seconds and then I log on, avast! blocks it.
This “experiment” has been performed in a slow PC (Pentium II, 400 MHz), so maybe this problem doesn’t happen in a faster PC.
However, I think avast! could always prevent this problem if it scans the programs that will be run in the next logon (what it already does, if it is started manually) when the system shuts down (that's my suggestion).
Sorry again for the mistake.