Potentially large glitch in IMF

[Ibrad]

Hey,

 

So I decided to do some more testing of IMF to figure out what file guard is. However I think I ran into an even bigger bug. On my machine if I download the EICAR test file in Firefox an on-demand scan picks up the EICAR test file. If I download the EICAR test file in Internet Explorer IMF does NOT detect Eicar on an on-demand scan. I have dragged around the file, uploaded it to VirusTotal to make sure it was not corrupted (it confirmed it was not). The main difference is on Firefox EICAR is being downloaded into my download file while in Interenet Explorer its being downloaded to my desktop.

 

Any ideas?

[Buddahfan]

Hey,

 

So I decided to do some more testing of IMF to figure out what file guard is. However I think I ran into an even bigger bug. On my machine if I download the EICAR test file in Firefox an on-demand scan picks up the EICAR test file. If I download the EICAR test file in Internet Explorer IMF does NOT detect Eicar on an on-demand scan. I have dragged around the file, uploaded it to VirusTotal to make sure it was not corrupted (it confirmed it was not). The main difference is on Firefox EICAR is being downloaded into my download file while in Interenet Explorer its being downloaded to my desktop.

 

Any ideas?

 

I am suprised your anti-malware software allows you to download the EICAR files. BD W8 Security does not permit this. Good job BD.

[scrd01]

downloads firefox

 

Hi Ibrad,

the choice of where you download too, is an option within FF, i send all my downloads to my desktop,

Firefox>options>general>download to

 

Roy

[enoskype]

Hi Buddahfan,

 

As far as User Profile of Ibrad is concerned, it seems that he does not use any antivirus software.

 

Although it says lately on the download page that it is antimalware test file, eicar is for testing antivirus softwares.

FYI, using of Bitdefender A/V engine, ASCU's action about eicar is as good as Bitdefender.

IMF is not an Antivirus software, but a good companion antimalware to any A/V software. It should not be used alone without an Antivirus software.

 

Reasons for testing anti-virus software

 

Obviously, there is considerable intellectual justification for testing anti-virus software against real viruses. If you are an anti-virus vendor, then you do this (or should do it!) before every release of your product, in order to ensure that it really works. However, you do not (or should not!) perform your tests in a "real" environment. You use (or should use!) a secure, controlled and independent laboratory environment within which your virus collection is maintained.

 

Using real viruses for testing in the real world is rather like setting fire to the dustbin in your office to see whether the smoke detector is working. Such a test will give meaningful results, but with unappealing, unacceptable risks.

 

Since it is unacceptable for you to send out real viruses for test or demonstration purposes, you need a file that can safely be passed around and which is obviously non-viral, but which your anti-virus software will react to as if it were a virus.

If your test file is a program, then it should also produce sensible results if it is executed. Also, because you probably want to avoid shipping a pseudo-viral file along with your anti-virus product, your test file should be short and simple, so that your customers can easily create copies of it for themselves.

 

The good news is that such a test file already exists. A number of anti-virus researchers have already worked together to produce a file that their (and many other) products "detect" as if it were a virus.

 

Agreeing on one file for such purposes simplifies matters for users: in the past, most vendors had their own pseudo-viral test files which their product would react to, but which other products would ignore.

 

The Anti-Malware Testfile

 

This test file has been provided to EICAR for distribution as the "EICAR Standard Anti-Virus Test File", and it satisfies all the criteria listed above.

 

It is safe to pass around, because it is not a virus, and does not include any fragments of viral code. Most products react to it as if it were a virus (though they typically report it with an obvious name, such as "EICAR-AV-Test").

 

The file is a legitimate DOS program, and produces sensible results when run (it prints the message "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!").

 

Please find attached the images about actions of Advanced SystemCare Ultimate 6 and IObit Malware Fighter 1.7.

 

NOTE: For IMF to act, eicar.zip file is put to whitelist of ASCU.

Also, in the mean time, IE10's smart filter blocked download of eicar.com.

 

Cheers.

[Ibrad]

Yes I use Antivirus on all my personally used machines this was a test machine just to give Iobit Malware Fighter a test run which was why I was reporting this :)

[Buddahfan]

Hi Buddahfan,

 

As far as User Profile of Ibrad is concerned, it seems that he does not use any antivirus software.

 

Although it says lately on the download page that it is antimalware test file, eicar is for testing antivirus softwares.

FYI, using of Bitdefender A/V engine, ASCU's action about eicar is as good as Bitdefender.

IMF is not an Antivirus software, but a good companion antimalware to any A/V software. It should not be used alone without an Antivirus software.

 

 

 

Please find attached the images about actions of Advanced SystemCare Ultimate 6 and IObit Malware Fighter 1.7.

 

NOTE: For IMF to act, eicar.zip file is put to whitelist of ASCU.

Also, in the mean time, IE10's smart filter blocked download of eicar.com.

 

Cheers.

 

With all due respect to IObit ASCU does not compare to BD W8 Security. While IObit uses a Bitdefender scanning engine I doubt it is the same scanning engine used in BD W8 Security. In order to use the Bitdefender scanning engine IObit would have had to license it from Bitdefender. I doubt that Bitdefender is going to license their latest scanning technology to a competitor. My guess is that IObt licensed an older version of the Bitdefender scanning engine. I also say this because Bitdefender changed their scanning engine with their 2013 products. To my knowledge BD W8 Security was realeased after ASCU was.

 

As far as the EICAR test goes I hear you. However, I trust Bitdefender otherwise I wouldn't be using BD W8 Security. If they are blocking the download the the EICAR file ISTM since the EICAR file has been available for a quite a while that Bitdefenfer knew what they were doing when they designed BD W8 Security to block the EICAR files download by default.

 

P.S. BD W8 Security has a lot more security options than ASCU does. ASCU is like a AV program with a phishing program attached. BD W8 Security offers a lot more in the way of features. In addition, as I recall BD W8 Security also costs about 2.5 times more to license. It is a better and more complete security program than ASCU.

 

Does all this mean that ASCU is not a good anti-malwrare program? Of course not. It just means that BD W8 Security is better.

[Toppack]

Does all this mean that ASCU is not a good anti-malwrare program? Of course not. It just means that BD W8 Security is better.

 

I Agree, but even as Great as W-8 Security is,

I still think it is a Good idea to run two security programs,

since W-8 Security will be the Main-Target for Hackers now,

a 2nd backup security program is probably a good idea.

[enoskype]

FYI, using of Bitdefender A/V engine, ASCU's action about eicar is as good as Bitdefender.

 

Hi Buddahfan, :wink:

 

Is there any other meaning comparison wise in that sentence other than ASCU is as good as Bitdefender when eicar detection is concerned? :lol:

 

I wouldn't conclude from it that ASCU is as good or is better than BD W8 security in every respect. :-P

 

 

Hi Toppack,

 

Scissor or knife is more sharp (not sharper though)? :lol:

 

 

Cheers.

[Melvin_Deal]

Hi all!

 

Personally I think eicar is faulty by premise:shock:.

 

Sincerely,

-Mel

Live long and prosper!

[Ibrad]

Yes EICAR is not a fail proof way to test but why would it be detected when downloaded via Firefox and not IE?

[Toppack]

Yes EICAR is not a fail proof way to test but why would it be detected when downloaded via Firefox and not IE?

 

Which version of IE are we talking about?

Is it IE-9 or IE-10? (those are the only two that are not obsolete)

[Ibrad]

An older obsolete version, this was running on an old XP machine that cant handle any updates. I usually use Firefox but tested IE just to check if it would set out file guard.

 

I can confirm this is not it missing all IE downloaded files. I downloaded SpyCar from IE and it detects it just fine its just EICAR that has this issue

[Cicely]

Hi Ibrad,

 

Thank you for your feedback.

 

I have already reported the issue you mentioned to our programmers to do a further text.

 

If any new situations happened, please feel free to tell us.

[Ibrad]

Thanks for reporting it to them for me :)