Eicar test fails on Avast Free

[DavidR]

.com files because of their nature (basically exe files) should be scanned as part of the avast default file set.

[Vlk]

If it were a normal (Windows) executable it would get scanned on-exec not matter what the filename extension is.
The problem is caused by the fact that Eicar is not a Windows executable file.

[Lisandro]

The problem is caused by the fact that Eicar is not a Windows executable file.

Why don't you develop a always-block-eicar-test system to let the users calm down and trust avast:
I mean, a placebo-proof antivirus

[Guilap]

Unfortunately, the eicar test is the only one I know it's safe to try If I were to test with real infected files, I should do it in a controlled environment.

Besides that, Avira free passed this exact same test.

A third set of requests [for viruses] come from exactly the people you might think would be least likely to want viruses: "users of anti-virus software".

They want some way of checking that they have deployed their software correctly, or of deliberately generating a "virus incident in order to test their corporate procedures, or of showing others in the organisation what they would see if they were hit by a virus".

(...)

Using real viruses for testing in the real world is rather like setting fire to the dustbin in your office to see whether the smoke detector is working. Such a test will give meaningful results, but with unappealing, unacceptable risks.

[Vladimyr]

Unfortunately, the eicar test is the only one I know it's safe to try If I were to test with real infected files, I should do it in a controlled environment.

Spycar will try to do real "damage' (and repair it with 'Tow Truck' if necesary).

Out of interest, I also have XP SP3 on 7 PCs and AIS/APro stops 'eicar.com' on each as indicated.

[NON]

Unfortunately, the eicar test is the only one I know it's safe to try If I were to test with real infected files, I should do it in a controlled environment.

How about "Hikaru" (a Joke software)
http://www.virustotal.com/file-scan/report.html?id=3c13e6169994f9e5eab10642200b5e91457b93676c73e1695caee530623d4f0b-1277110749

Download:
http://www.vector.co.jp/download/file/win95/amuse/fh217070.html

A few minutes after executing, screaming women's voice / women's face appears. Reboot or kill the process via TaskManager fixes this.
Win32:Hikaru is a PUP detection, so you have to enable PUP option.

[yongsua]

Same as me.But you should try another method to test Avast! detect this virus(Refer to 13thSlayer's post.http://forum.avast.com/index.php?topic=63733.msg538709#msg538709

[yongsua]

Same as me.But you should try another method to test Avast! to detect this.(Refer to 13thslayer's post.)http://forum.avast.com/index.php?topic=63733.msg538709#msg538709

[Guilap]

Out of interest, I also have XP SP3 on 7 PCs and AIS/APro stops 'eicar.com' on each as indicated.

Yes, yours are the exact screens I get, but only if I add com files as custom extensions on "Scan when opening". Maybe this is a bug present only on Avast Free. Anyway, even when Avast blocks it, I miss the warning screen.

Thank you all for the suggestions of Spycar and Hikaru, they where the missing win32 eicar  All of them got blocked and removed when they were already in the filesystem (but, again, no warning screen).

Same as me.But you should try another method to test Avast! to detect this.(Refer to 13thslayer's post.)http://forum.avast.com/index.php?topic=63733.msg538709#msg538709

I believe every method should by valid. What if the infected file was on a USB stick that was already inserted when I booted?

[SafeSurf]

What if the infected file was on a USB stick that was already inserted when I booted?

Then you need something to disable autorun.inf in your machine and USB/flash drives like Panda USB Vaccine: 
http://www.pandasecurity.com/homeusers/downloads/usbvaccine/.  It gives you the option to "vaccine" your machine, which means it disables autoruns.inf, but with a simple click, you can enable it again.  And you can vaccinate any removable drive including USB sticks.  It does not conflict with Avast as I've been using it with no problems. 

There are other companies as well: Flash_Disinfector.exe by sUBs: http://experi3nc3.wordpress.com/2007/05/10/flash-disinfector-by-subs/, AutoRun Eater http://www.softpedia.com/get/Security/Secure-cleaning/Autorun-Eater.shtml.

[NON]

All of them got blocked and removed when they were already in the filesystem (but, again, no warning screen).

Is "SILENT/GAMING MODE" disabled?

Try to uncheck Settings -> Silent/Gaming mode -> Silent if a full-screen application is running.
(Just in case, avoid mis-recognized as full-screen)

[Guilap]

Thank you for the tips, SafeSurf!

Try to uncheck Settings -> Silent/Gaming mode -> Silent if a full-screen application is running.

You're right, I forgot that. Running a file from desktop counts as full-screen. Worked as expected for spycar and hikaru files.

But no matter if this setting is unchecked or not or if I try to run from desktop or cmd window, trying to run eicar.com never triggers a warning (even when Avast blocks and deletes it).