AVG 7.1 Resident Shield doesn't detect eicar.com

I recently installed AVG 7.1 on a trial basis and it has run without
problems except Resident Shield does not detect eicar.com when it is
opened (either by double-clicking on the file or using the "open"
command). A normal scan does detect the presence of eicar. This may
mean that Resident Shield will not detect any virus.

I have been in touch with AVG tech-support and have tried a number of
checks and possible solutions ranging from a complete reinstall to scans
with HijackThis. Problem persists.

If anyone has experienced this problem I would be grateful if you would
let me know what the likely causes might be.

I'm running the latest build of AVG 7.1 under Windows 98SE. Previously
I had Norton AV 2005 and Norton Firewall 2004 installed but have fully
uninstalled these programmes.

Thanks

"Cyco" <cyci@tric.net> wrote in message news:dv1lea$65m$1@ctb-nnrp2.saix.net...
> I recently installed AVG 7.1 on a trial basis and it has run without
> problems except Resident Shield does not detect eicar.com when it is
> opened (either by double-clicking on the file or using the "open"
> command). A normal scan does detect the presence of eicar. This may
> mean that Resident Shield will not detect any virus.
>
> I have been in touch with AVG tech-support and have tried a number of
> checks and possible solutions ranging from a complete reinstall to scans
> with HijackThis. Problem persists.
>
> If anyone has experienced this problem I would be grateful if you would
> let me know what the likely causes might be.
>
> I'm running the latest build of AVG 7.1 under Windows 98SE. Previously
> I had Norton AV 2005 and Norton Firewall 2004 installed but have fully
> uninstalled these programmes.
>
> Thanks

Detected by AVG on my XP computer. Right click/open, double click, right click and scan file, right
click folder
it's in and scan folder.
Try a new copy of eicar.com from
http://www.eicar.org/anti_virus_test_file.htm

"Cyco" <cyci@tric.net> wrote in message news:dv1lea$65m$1@ctb-nnrp2.saix.net...
> I recently installed AVG 7.1 on a trial basis and it has run without
> problems except Resident Shield does not detect eicar.com when it is
> opened (either by double-clicking on the file or using the "open"
> command). A normal scan does detect the presence of eicar. This may
> mean that Resident Shield will not detect any virus.

Yes, this is a good example of the worth of the EICAR test file. Failure
to detect the EICAR is indeed cause for worry.

What is the length of the EICAR file you are using?

Could you post the contents of the EICAR file here?

On Sun, 12 Mar 2006 18:26:34 GMT, "Sanjaya"
<sanjaya_49@yahooNOSPAM.com> wrote:


>Detected by AVG on my XP computer. Right click/open, double click, right click and scan file, right
>click folder
>it's in and scan folder.
>Try a new copy of eicar.com from
>http://www.eicar.org/anti_virus_test_file.htm
>

Thanks. Resident Shield doesn't seem to detect eicar under any of the
commands you list. Eicar simply opens up in a DOS window. I
downloaded a new copy of eicar.com from the above url. Still doesn't
work :-(

On Sun, 12 Mar 2006 14:58:23 -0500, "Jake Dodd" <default@fake.invalid>
wrote:


>Yes, this is a good example of the worth of the EICAR test file. Failure
>to detect the EICAR is indeed cause for worry.
>
>What is the length of the EICAR file you are using?
>
>Could you post the contents of the EICAR file here?
>

Thanks for the reply. Here's the eicar string:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

"Cyco" <cyci@tric.net> wrote in message news:lmda12ppmusd76315qck6k5t909li629dn@4ax.com...
> On Sun, 12 Mar 2006 14:58:23 -0500, "Jake Dodd" <default@fake.invalid>
> wrote:
>
>
> >Yes, this is a good example of the worth of the EICAR test file. Failure
> >to detect the EICAR is indeed cause for worry.
> >
> >What is the length of the EICAR file you are using?
> >
> >Could you post the contents of the EICAR file here?
> >
>
> Thanks for the reply. Here's the eicar string:
>
> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Good string, bad scanner. A scanner that supports the use of the EICAR string
should detect an executable file containing only this string (68 bytes) or one with
this string and a carriage return/line feed appended (70 bytes).

I only asked to avoid the possibility that a corrupted string was being used.

It appears that your resident shield is indeed not working (at least not for
comfiles) have you tried it with a .exe extension?

"Cyco" <cyci@tric.net> wrote in message
news:dv1lea$65m$1@ctb-nnrp2.saix.net...
>I recently installed AVG 7.1 on a trial basis and it has run without
>problems except Resident Shield does not detect eicar.com when it is opened
>(either by double-clicking on the file or using the "open" command). A
>normal scan does detect the presence of eicar. This may mean that Resident
>Shield will not detect any virus.
>
> I have been in touch with AVG tech-support and have tried a number of
> checks and possible solutions ranging from a complete reinstall to scans
> with HijackThis. Problem persists.
>
> If anyone has experienced this problem I would be grateful if you would
> let me know what the likely causes might be.
>
> I'm running the latest build of AVG 7.1 under Windows 98SE. Previously I
> had Norton AV 2005 and Norton Firewall 2004 installed but have fully
> uninstalled these programmes.
>

You may already have a virus/spyware hijack

download the Stinger from here and run it in all accounts , while in Safe
Mode, to make sure that A-V-disabling
viruses are not present on your PC
http://vil.mcafeesecurity.com/vil/averttools.asp

- update your virus scanner and run a full system scan of all files.


--
Noel Paton (MS-MVP 2002-2006, Windows)

Nil Carborundum Illegitemi
http://www.crashfixpc.com/millsrpch.htm

http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"Jake Dodd" <default@fake.invalid> wrote in message
news:121b2i48fe0g248@corp.supernews.com...
>
> "Cyco" <cyci@tric.net> wrote in message
news:lmda12ppmusd76315qck6k5t909li629dn@4ax.com...
> > On Sun, 12 Mar 2006 14:58:23 -0500, "Jake Dodd"
<default@fake.invalid>
> > wrote:
> >
> > >Yes, this is a good example of the worth of the EICAR test file.
Failure
> > >to detect the EICAR is indeed cause for worry.
> > >
> > >What is the length of the EICAR file you are using?
> > >
> > >Could you post the contents of the EICAR file here?
> > >
> > Thanks for the reply. Here's the eicar string:
> >
> >
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
>
> Good string, bad scanner. A scanner that supports the use of the EICAR
string
> should detect an executable file containing only this string (68
bytes) or one with
> this string and a carriage return/line feed appended (70 bytes).
>
> I only asked to avoid the possibility that a corrupted string was
being used.
>
> It appears that your resident shield is indeed not working (at least
not for
> comfiles) have you tried it with a .exe extension?
>
I tried saving the string as Eicar.com and NOD32 immediately quarantined
it.

I keep Eicar.com a zipped version of Eicar.com and a doubled zipped
version on all of my systems to check out my on demand scans.

Chas.

On Mon, 13 Mar 2006 10:01:59 -0500, "Jake Dodd" <default@fake.invalid>
wrote:

>
>Good string, bad scanner. A scanner that supports the use of the EICAR string
>should detect an executable file containing only this string (68 bytes) or one with
>this string and a carriage return/line feed appended (70 bytes).
>
>I only asked to avoid the possibility that a corrupted string was being used.
>
>It appears that your resident shield is indeed not working (at least not for
>comfiles) have you tried it with a .exe extension?
>

Thanks for the response. Yes, I've tried changing the extension and
setting Resident Shield to scan "all files". Still doesn't work.

Cyco, 3/13/2006, 5:04:11 AM,
<lmda12ppmusd76315qck6k5t909li629dn@4ax.com> wrote:

> On Sun, 12 Mar 2006 14:58:23 -0500, "Jake Dodd" <default@fake.invalid>
> wrote:
>
>
> > Yes, this is a good example of the worth of the EICAR test file.
> > Failure to detect the EICAR is indeed cause for worry.
> >
> > What is the length of the EICAR file you are using?
> >
> > Could you post the contents of the EICAR file here?
> >
>
> Thanks for the reply. Here's the eicar string:
>
> X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Make sure there's not an extra space at the beginning of the string.