avast4 & ZIP file

[mantra]

I put a eicar test file in a zipped file

i select provider (residen protection ) zipped file

i click on the zipped file and nothing!!!
avast doesn't scream why?

[igor]

What exactly does it mean that you "clicked on the zipped file"?
What are your resident protection settings?

[Waldo]

well, if you right click on the zip file (explorer) and choose > scan, AVAST should warn you.

If you only opened the zip file, and didn't excecute Eicar file,, than AVAST resident provider will not detect it.

If you launch the Eicar file, AVAST will warn you.

The resident protection only works on executed (running)programs, this means it uses no memory scan.

I hope this is a answer to your question.

Waldo

[mantra]

i started the shiel provider
and i edit it
and under archives
i select zip archive


i click on the test.zip and i doesn't scream

i have to click on the eicar.com(into the zip) to make avast scream

[igor]

Do you have the .zip extension configured to be scanned on open? (second page of the standard shield configuration) - by default only .wsh files are scanned on open, if i remember correctly.

[Waldo]

i click on the test.zip and i doesn't scream

i have to click on the eicar.com(into the zip) to make avast scream

well, thats what i tried to explain you in my previous answer > it only scans executed files, that is :pressing eicar.com

But when you should right click on the .zip file, the Avquick is excetuded, that will detect
the Eicar file inside the packer.

Waldo

[mantra]

yah right igor thanks

[igor]

Waldo: Scanning executed files is the most important, of course - but it can do much more: scan on opening (i.e. when you try to read it), scan on modification (when it's created/written) etc. Of course, the more scanning you set, the more it will slow down your computer (even more when you turn on the archives scanning). It's up to you what settings you prefer...
In any case, the "executed files scan" should catch the virus even when everything else is disabled (of course, the "executed files scan" has to be enabled