EICAR Test Virus

[bryanjoe]

Currently trialling the site on AVG Free (not sure if this is one the official site)

http://www.rexswain.com/eicar.html

AVG Free managed to Prompt Alert on eicar.com when downloading

No response for the other 2 when downloading.
Alert was prompted when on-demand scan of the 2 files...

Still not so bad.

What is your antivirus software and does it prompt u of virus activity on the 2 zip files?

[Tarq57]

I've clicked on them from here http://www.eicar.org/anti_virus_test_file.htm and Avast home blocked all four in http, (Page wouldn't open..."cannot be displayed" message) but in https, only blocked 1, 3 &4 , and the zipped ones only when open attempted. The txt file (2) displayed in the web page, no bells or whistles went off.
Interesting. I wonder why the difference? Might have to ask at the Avast forum.

[C.S.J]

f-secure 2007 automatically blocks / prevents or removes ALL before it can get on the machine.

[ASpace]

@bryanjoe

Hi . I use NOD. Its internet scanner blocks all files (including the archives) . Anyway , if your AVG doesn't pop-up on the zip files , don't worry , when the ZIP is unpacked , it will :-)

[Tarq57]

Quote from one of the folks at Avast:

"The Web Shield scans only the HTTP traffic of the browser, that's why standard protocol http eicar files are detected. The others four samples of the eicar test, which use the secure HTTPS protocol are not detected during download by the Web Shield, because the Web Shield simply do not scan this traffic. So when you download the four samples on your PC and do a scan with avast!, all of them will be detected "

I can confirm this is the case.

[Banshee]

I clicked on the eicar.com.txt file and f-secure did nothing.a few seconds later a blank new window opened and all I could see was this:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*



wasn't f-secure supposed to block this page ?

[huntnyc]

Antivir Security suite denies access when trying to download. I guess it's working then.

Gary

[ASpace]

-{ Quote: "
wasn't f-secure supposed to block this page ?" }-

Yes , but only if F-Secure is set to scan TXT files . Many AVs doesn't scan TXT files by default because TXT doesn't bring malware in them ;)

[Inspector Clouseau]

-{ Quote: "because TXT doesn't bring malware in them ;)" }-

1. Open Notepad
2. Write exactly "Mike has you owned" (without enter and without quotes)
3. Save it
4. Reopen it with Notepad ;D

[Banshee]

-{ Quote: "1. Open Notepad
2. Write exactly "Mike has you owned" (without enter and without quotes)
3. Save it
4. Reopen it with Notepad ;D" }-


Just did. When I opened the txt file all I could see was this:

楍敫栠獡礠畯漠湷摥

?????

[ASpace]

Mike (IC) created a new Halloween virus for Notepad ;D ;D ;D ;D <just kidding , of course>

[EraserHW]

hahaha ;D Mike ownz you ;D this is a nice old trick :)

It was born with "Bush hid the facts", but every string that has <4 letter> <3 letters> <3 letters> <5 letters> works :D It's some unicode parsing bug in notepad :)

[Banshee]

An old trick ? Ok, I am slow.But.Why do I get those "chinese" kind-of-like things?

I really don't get it:wacko:

[ggf31416]

-{ Quote: "Why do I get those "chinese" kind-of-like things?" }-

http://blogs.msdn.com/oldnewthing/archive/2004/03/24/95235.aspx

[Banshee]

Have a look:

[lodore]

-{ Quote: "I clicked on the eicar.com.txt file and f-secure did nothing.a few seconds later a blank new window opened and all I could see was this:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*



wasn't f-secure supposed to block this page ?" }-


when you save the file you call it a filename with the .com extension on the end for it to work

[lodore]

-{ Quote: "1. Open Notepad
2. Write exactly "Mike has you owned" (without enter and without quotes)
3. Save it
4. Reopen it with Notepad ;D" }-

great one mike:thumb: lmao

[C.S.J]

-{ Quote: "I clicked on the eicar.com.txt file and f-secure did nothing.a few seconds later a blank new window opened and all I could see was this:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*



wasn't f-secure supposed to block this page ?" }-

i have tried this page with f-secure,

it loads up a white page, without that text and in the bottom right corner, it pops up (animated slide) "virus has been removed"

maybe check your f-secure settings

[Banshee]

-{ Quote: "i have tried this page with f-secure,

it loads up a white page, without that text and in the bottom right corner, it pops up (animated slide) "virus has been removed"

maybe check your f-secure settings" }-


Oops I had scan web traffic unticked.Enabled that and that did the trick.Thanks CSJ

[C.S.J]

-{ Quote: "Oops I had scan web traffic unticked.Enabled that and that did the trick.Thanks CSJ" }-

no problem, i would suggest you set it to ask you about everything in the system control for better protection, if you need it ;D

[pykko]

LOL, Mike! That's super. ;D