EICAR test file download

Discussion in 'ESET Smart Security v3 Beta Forum' started by maniac2003, May 12, 2007.

Thread Status:
Not open for further replies.
  1. maniac2003

    maniac2003 Registered Member

    Joined:
    Apr 12, 2007
    Posts:
    68
    Location:
    Netherlands
    Yesterday I tried the suite for a moment to see what it looks like. To see if everything was right I decided to hop to the EICAR test (http://www.eicar.org/anti_virus_test_file.htm)
    But I could just download the file o_O after unpacking/running the file NOD alarmed me.

    So I reverted back to the old NOD AV, and when I try to download the file. Immediatly I'm given a window, with a virus warning.

    Have I found a flaw in the suite, or is this normal ? I also found the same behaviour in ZA AV.
     
  2. helioscreation

    helioscreation Registered Member

    Joined:
    Sep 30, 2006
    Posts:
    32
    Location:
    Nimes (France)
    Here, impossible to download the zip file.
    And each file i click is giving me a 'eset warning'.
    I can't even see the download bar ... it's block before the download.
     
  3. fosius

    fosius Registered Member

    Joined:
    Oct 14, 2004
    Posts:
    479
    Location:
    Partizanske, Slovakia
    I can confirm that once it is detected and connection terminated and another time it is undetected.... Strange...(eicarcom2.zip)
     
  4. ASpace

    ASpace Guest

    Yes , it is strange . However , this does not happen here (at least with Eicar) . It happens for me only with Trojan Simulator.

    It seems that it is not only with Trojan simulator but in general .

    This is the internet scanner (which is part of the firewall) . The on-access scanner is working perfectly .
     
  5. JeremyWW

    JeremyWW Registered Member

    Joined:
    Apr 13, 2005
    Posts:
    237
    Works fine here - consistent - connection terminated on all Eicar downloads. Running Beta 1a.
     
  6. maniac2003

    maniac2003 Registered Member

    Joined:
    Apr 12, 2007
    Posts:
    68
    Location:
    Netherlands
    I also had the latest running, and had everything on expect the antispam module. Weird...
     
  7. OMEGA_RAZER

    OMEGA_RAZER Registered Member

    Joined:
    Apr 11, 2007
    Posts:
    94
    Location:
    24.24.2.2147
    Works perfect here. Cuts out the secure downloads as well...
     
  8. fosius

    fosius Registered Member

    Joined:
    Oct 14, 2004
    Posts:
    479
    Location:
    Partizanske, Slovakia
    I have also found out that on-access scanner sometimes leaves malware undetected. I have already sent evidence to Eset.
     
  9. bluesprite

    bluesprite Registered Member

    Joined:
    Apr 11, 2007
    Posts:
    71

    I confirm the problem with the Trojan simulator. The Eicar file is detected every single time, but Trojan simulator can be saved on the hard disk the second time.
     
  10. ASpace

    ASpace Guest

    I think there is something with this trojan simulator because I also tried a multiple infiltrations rar archive .

    I created an archive with Eicar and trojan simulator in different forms and attempted to download this . ESS detected a mulitple infiltrations and reported blocked but an on-demand scan later showed Trojan Simulator file in IE's cache . No Eicar or other , just Trojan simulator .

    I have already reported to ESET :)
     
  11. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    AMON does not scan inside archives, no wonder it did not detect it in the temp folder. Since firewall currently works in higher compatibility mode, it's possible that it terminates a threat, but the browser tries to download the last packet again. The last packet, of course, is not detected by ESS as it's just a mix of 0 and 1.
     
  12. ASpace

    ASpace Guest

    I use NOD32 2.7 / IMON with Higher compatibility for all applications , too and in it it gets blocked there . Only in ESS there is such an issue.
     
Thread Status:
Not open for further replies.