EICAR Email Virus Test. Is this behavior Normal?

HI,
I just made a test with, http://www.aleph-tec.com/eicar/index.php, and selected eicar.com, standard anti-virus test file.
This is how my AV behaved(KAV Personal pro 4.5.104):
- I'm using thunderbird Mozilla
- I received the email. KAV didn't react
- I read the email. KAV didn't react
- I tried to save the attached file. KAV reacted. A virus has been detected.

Is it normal, that KAV react only after I tried to save/open the attached file?

 

For this version of Kav it is normal, if you don't use Outlook. When using Outlook, all e-mail is scanned and Kav should be triggered when an infection is detected, depending on your configuration ofcourse!!!!
The new version 5.0 of Kav scans all pop3 mail.
So....in your case Kav reacted ok when truying to open or save this infected file, but I would not be happy with this option either and therefore I use a virusscanner with the pop3 scanning abilty (Dr. Web at the moment).
But there are more scanners with this ability and I already mentioned Kav 5.0, but I didn't like this version because of the system slowdown. You may need to follow some course in order to get Kav 5.0 running light......(see thread about Kav 5.0 for speed etc. by BlueZannetti) and this made my choice for Dr. Web easy.
I think it is crazy if you have to perform such deep operations to get an AV scanner working the way it should.

Try this site for the eaicar mailtest and see what happens with most scanners.....just terrible. The only scanners that detected and dealt properly with most of the infections were Dr. Web and AVG !!!!!!

http://www.testvirus.org/

Good luck!

Putin