EICAR test file download

Yesterday I tried the suite for a moment to see what it looks like. To see if everything was right I decided to hop to the EICAR test (http://www.eicar.org/anti_virus_test_file.htm)
But I could just download the file after unpacking/running the file NOD alarmed me.

So I reverted back to the old NOD AV, and when I try to download the file. Immediatly I'm given a window, with a virus warning.

Have I found a flaw in the suite, or is this normal ? I also found the same behaviour in ZA AV.

 

Here, impossible to download the zip file.
And each file i click is giving me a 'eset warning'.
I can't even see the download bar ... it's block before the download.

 

I can confirm that once it is detected and connection terminated and another time it is undetected.... Strange...(eicarcom2.zip)

 

Yes , it is strange . However , this does not happen here (at least with Eicar) . It happens for me only with Trojan Simulator.

It seems that it is not only with Trojan simulator but in general .

This is the internet scanner (which is part of the firewall) . The on-access scanner is working perfectly .

 

Works fine here - consistent - connection terminated on all Eicar downloads. Running Beta 1a.

 

I also had the latest running, and had everything on expect the antispam module. Weird...

 

Works perfect here. Cuts out the secure downloads as well...

 

I have also found out that on-access scanner sometimes leaves malware undetected. I have already sent evidence to Eset.

 

I confirm the problem with the Trojan simulator. The Eicar file is detected every single time, but Trojan simulator can be saved on the hard disk the second time.

 

I think there is something with this trojan simulator because I also tried a multiple infiltrations rar archive .

I created an archive with Eicar and trojan simulator in different forms and attempted to download this . ESS detected a mulitple infiltrations and reported blocked but an on-demand scan later showed Trojan Simulator file in IE's cache . No Eicar or other , just Trojan simulator .

I have already reported to ESET

 

AMON does not scan inside archives, no wonder it did not detect it in the temp folder. Since firewall currently works in higher compatibility mode, it's possible that it terminates a threat, but the browser tries to download the last packet again. The last packet, of course, is not detected by ESS as it's just a mix of 0 and 1.

 

I use NOD32 2.7 / IMON with Higher compatibility for all applications , too and in it it gets blocked there . Only in ESS there is such an issue.