Eicar virus test not detected by Web Shield

[Jonas_FR]

I tried to download "Eicar virus test" file : http://www.eicar.org/85-0-Download.html using native android web browser.

=> "avast! Mobile Security" didn't block me and I was able to download "eicar.com.txt".

- Web Browser : native android browser (I don't know to get web browser version)
- Android version : 2.3.5
- Phone : HTC Desire S
- Web shield is enabled in settings menu.
- If I do a scan using "Virus Scanner" menu, avast find Eicar correctly on my SD card.
- Same issue with Firefox mobile 8.0.

- Vlk says "Web Shield: The avast! Web Shield for Android scans each URL that loads and warns you if the browser loads a malware-infected URL." (http://forum.avast.com/index.php?topic=89990.0)
=> I understand that "avast! Mobile Security" only checks if the requested URL exists in the avast blacklisted URLs.
So It "works as designed" but it could be good to detect Eicar because it's the first test (some) people do when they try a new antivirus.

[svehlak]

Yes, web shield checks URL, not the content; you have to run the scanner to find it. Scanner should run after the file is downloaded and saved.

[Jonas_FR]

I have the same issue as wpn user :
"you say the realtime protection is active, i downloaded the EICAR virus in the form of  .com and .zip file. Both successfully downloaded to my SDCARD, only after the manual scan it was found."
http://forum.avast.com/index.php?topic=89990.msg716495#msg716495

I also tried to open "eicar.com.txt" with Quickoffice app, Drop box text editor or Firefox and avast didn't block me.

I use "OI file manager" to select the Eicar file and open it.
(https://market.android.com/details?id=org.openintents.filemanager)

By the way, I like avast! Mobile Security and it will be a great product.

Android : v2.3.5
Phone : HTC Desire S (not rooted)

[Jan Gahura]

The realtime protection scans each APK right after it is installed on the phone (and prior its execution). It's not possible to check each read/write to the storage deu to the Android OS architecture. It could be theoretically done for rooted phones.

Try to install EICAR from market (there's at least one) and you'll see the realtime protection in action.

[RejZoR]

Is there any chance that APK executes itself on its own right after installation? Or does user have to run it on their own?

[Filip Havlicek]

As long as it's not your own application - no. The user always has to invoke the first run (and before he does, avast! will already have the application scanned because it reacts to the application installation).