| BullGuard And Eicar.org I don't quite understand this. I installed BullGuard IS yesterday. I wanted to test it out using the eicar file. I went to eicar.org, clicked on the test links, and get this message....
eicar.com is not a valid Win32 application.
I get this also when I open the eicar zip test. I thought maybe this is the way BullGuard works. I decided to shut down the BullGuard real time protection to see what would happen. I get the same thing. Is this Win7 stopping the eicar file before BullGuard has a chance to do it's job? I've never had this happen with any other antivirus software. |
|
Reviews:
 ·WestNet Broadband
| This is the alert for me:
Also Win 7 and .com files might be worth looking at this question asked - »answers.microsoft.com/en-us/wind···32d3d998 |
|
 Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7 | reply to Graystoke
Maybe EICAR is a DOS program and unable to run on Windows 7
»answers.microsoft.com/en-us/wind···9479c73c |
|
| @norwegian.......I got that same message also.
Thanks norwegian, and Name Game. Looks like that answers the question. |
|
BobAccount deleted
join:2012-07-22
New Jersey | I just take the 68 byte string and cut & paste it into Notepad, then save it as a text file. That should be pickup up by the antivirus program. |
|
Mele20Premium
join:2001-06-05
Hilo, HI
kudos:4 | reply to Graystoke
Can't you download the zipfile of EICAR? Most AV will catch it before it even downloads. I can't see why that would be different on a 64bit OS.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson |
|
|
|
| reply to Bob
You can download the .txt file too at the site. |
|
| reply to Mele20
The .com file for me is detected on download, without worrying about the .zip file. |
|
Reviews:
·WestNet Broadband
| reply to Graystoke
said by Graystoke:@norwegian.......I got that same message also.
That is the alert from Windows with my A/V turned off. As mentioned above to Mele20  , my A/V detects it fine. I wonder why BullGuard isn't alerting to it then? |
|
Mele20Premium
join:2001-06-05
Hilo, HI
kudos:4 | reply to norwegian
said by norwegian:The .com file for me is detected on download, without worrying about the .zip file.
It is for me also but I have XP Pro 32bit. I gather the problem here is Win 7 64bit.
Proxomitron renders the text file harmless and no download attempt occurs. I just get a new tab with the eicar string in plain text. I have to bypass Proxo if I want to download the text file (or try to download it as my AV catches it immediately. I remember though years ago that AV did not catch any of them during download but only later. Then eicar.com became detected during download by most AV but the .zip ones frequently had to be fully downloaded and unzipping begun before AV would detect. So, in the past, doing the .zip ones was a good idea when trialing a new AV).
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson |
|
Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7
1 edit | reply to norwegian
Because EICAR.com is a DOS program and unable to run on Windows 7 so why would you expect an AV to Id it ? Also would happen if you downloaded the zip..which is OK..but then tried to open it...and that would not only be for win7 64 but also 32. If you really want to run it..read the link I posted and make those changes to your win7.
The caution would be
" Note: you cannot run XP Mode on Windows 7Home editions. If you are using Windows 7 Home Premium, you would need to use Virtual Box, DosBox or any other 3rd party virtualization program that works with Home Premium. Please visit forums dedicated to these programs for more information." |
|
Reviews:
·WestNet Broadband
| Ah, so Graystoke is running the program and nothing is detected because it isn't valid.
I get alerts a long time before that. Running the file would need me to turn off a lot of settings. All good. 
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke
|
|
Reviews:
·WestNet Broadband
| reply to Name Game
said by Name Game:
" Note: you cannot run XP Mode on Windows 7Home editions. If you are using Windows 7 Home Premium, you would need to use Virtual Box, DosBox or any other 3rd party virtualization program that works with Home Premium. Please visit forums dedicated to these programs for more information."
On this point, even on Win 7 x64 Ultimate, on right clicking the file, there is no option for XP mode or any other compatibility mode though either, even in properties. I thought that was allowable via the context menu in the upper versions of Win 7?
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke
|
|
Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7 | Then try this since Eicar is an MS-dos program
Most existing 16-bit and MS-DOS-based programs were originally written for Windows 3.0 or Windows 3.1. Windows 7 runs these older programs using a virtual machine that mimics the 386-enhanced mode used by Windows 3.0 and Windows 3.1. Unlike on other recent releases of Windows, on Windows 7 each 16-bit and MS-DOS-based application runs as a thread within a single virtual machine. This means that if you run multiple 16-bit and MS-DOS-based applications, they all share a common memory space. Unfortunately, if one of these applications hangs or crashes, it usually means the others will as well.
You can help prevent one 16-bit or MS-DOS-based application from causing others to hang or crash by running it in a separate memory space. To do this, follow these steps:
1. Right-click the program’s shortcut icon and then click Properties. (If the program doesn’t have a shortcut, create one, and then open the shortcut’s Properties dialog box.)
2. On the Shortcut tab, click the Advanced button. This displays the Advanced Properties dialog box.
3. Select the Run In Separate Memory Space check box.
4. Click OK twice to close all open dialog boxes and save the changes.
NOTE: Running a program in a separate memory space uses additional memory. However, you’ll usually find that the program is more responsive. Another added benefit is that you are able to run multiple instances of the program—as long as all the instances are running in separate memory spaces.
--
Gladiator Security Forum
»www.gladiator-antivirus.com/
|
|
Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7 | reply to Graystoke
You might also be interested in this for future reference...
HOW TO: Identify a 16-bit Program in Windows XP
»support.microsoft.com/kb/320127 |
|
Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7 | reply to Graystoke
Interesting note for Google Chrome users..even if you have WinXP..you will get two warnings from Google Chrome when .com file tries to download..first will be the screen shot above cautioning you...(see bottom left corner of the screenshot).. then even if you say contiune and do not discard you will get another warning telling you it could harm you PC. As a friend of mine said the other day .com use to be an executable program..now it is just a domain. 
--
Gladiator Security Forum
»www.gladiator-antivirus.com/
|
|
Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7 | reply to norwegian
said by norwegian:Ah, so Graystoke is running the program and nothing is detected because it isn't valid.
I get alerts a long time before that. Running the file would need me to turn off a lot of settings. All good.
No he is not running it. just like you he can't.
--
Gladiator Security Forum
»www.gladiator-antivirus.com/
|
|
| Ok, you win the round, my shout. |
|
Name GamePremium
join:2002-07-07
North Myrtle Beach, SC
kudos:7 | Was not a competition..but is time for another cuppa |
|
1 edit | reply to Graystoke
graystoke, i think that an antivirus program should flag the eicar.com test-file regardless of whether or not the file will run on a person's computer.. that has been my experience.. |
|
