lafa20 Posted September 1, 2013 Report Share Posted September 1, 2013 hello, if i try downloading eicar.txt via chrome, EAM guard doesn't respond in any way. i can even read the file. if i try to copy the downloaded file the guard blocks the copied file, but not the source. i can also zip the file successfully, but when i try to extract it, the guard responds again. attached is a pic of the guard configuration (after a fresh clean installation). no other security programs are running in real-time, except for online armor. thanks Link to comment Share on other sites More sharing options...
lafa20 Posted September 1, 2013 Author Report Share Posted September 1, 2013 i can also edit the file, save it (not 'save as' but plain 'save'), edit again to return the exact eicar string, and nothing... no response. Link to comment Share on other sites More sharing options...
GT500 Posted September 4, 2013 Report Share Posted September 4, 2013 We already have a bug report open on this, so I'll add your information and a link to this forum topic to the bug report. Edit: I assume you are experiencing this issue on Windows XP? Also, what version of Google Chrome are you using? Link to comment Share on other sites More sharing options...
lafa20 Posted September 4, 2013 Author Report Share Posted September 4, 2013 great. i am using windows xp. chrome 29.0.1547.66. thanks ! Link to comment Share on other sites More sharing options...
Fabian Wosar Posted September 4, 2013 Report Share Posted September 4, 2013 The problem is the extension filter in this case. The way Chrome works is that it downloads the file first using the .crdownload extension. When this file finished downloading and is closed, this would normally trigger the on-modify scan, but since the extension is not in the list of file extensions to be scanned, it won't be scanned. Chrome then renames the file to the actual file name (eicar.txt). A file rename doesn't change a file's content, so it does not trigger a scan. All other actions you mentioned don't trigger file changes either, so again they don't trigger scans of the source file. To fix it, you can either add the .crdownload to the list of file extensions to scan or disable the file extension filter completely. Link to comment Share on other sites More sharing options...
calcu007 Posted September 7, 2013 Report Share Posted September 7, 2013 Other solution is that EAM add HTTP streaming scanning, Link to comment Share on other sites More sharing options...
Fabian Wosar Posted September 7, 2013 Report Share Posted September 7, 2013 We have no plans to add any kind of stream scanning. The technology is way too error prone and doesn't work for encrypted connections without severely lowering the provided security. Link to comment Share on other sites More sharing options...
calcu007 Posted September 7, 2013 Report Share Posted September 7, 2013 I have seen others security programas(like Avast) that have it without problem. It will increase your chances to detect a malware before it download or try to run in a computer Link to comment Share on other sites More sharing options...
Stalker90 Posted September 7, 2013 Report Share Posted September 7, 2013 I also have this problem,i use Win 7 x64 SP1..I had added .crdownload extension into list,and i downloaded few malware from malwareblacklist...2 he blocked,but rest still not removed,even he show message about threat..Malware stands on desktop,no warning...after execution he block...On IE 8 all malware is emidietly blocked..Fix this bug asap Link to comment Share on other sites More sharing options...
Steve1209 Posted September 8, 2013 Report Share Posted September 8, 2013 Hi all, I use Chrome 100% and on advice of Fabian's post above I added .crdownload to the list. I tried to download Eicar.txt and it failed with the following screen shot EMSI seems to be working 100% for me... Win 7 X64 SP1 Hope that helps, Link to comment Share on other sites More sharing options...
Fabian Wosar Posted September 8, 2013 Report Share Posted September 8, 2013 I have seen others security programas(like Avast) that have it without problem. It will increase your chances to detect a malware before it download or try to run in a computer Then you don't use a lot of streaming applications (Youtube, Twitch, and Co.). When you go into forums of products offering stream scanning, you will see dozens of complains about slow or interrupted downloads, applications not being able to access the internet at all and so on. Leave alone the fact, that stream scanning is useless with encrypted connections, unless you completely destroy the guarantee that SSL offers you that you know who you are talking to. The way SSL stream scanning is implemented in most AVs is through the use of a proxy. So your browser will always say you are connected to a server with your AV's certificate, which is also trusted, completely masking the certificate of the server you are actually connected to. I also have this problem,i use Win 7 x64 SP1..I had added .crdownload extension into list,and i downloaded few malware from malwareblacklist...2 he blocked,but rest still not removed,even he show message about threat..Malware stands on desktop,no warning...after execution he block...On IE 8 all malware is emidietly blocked..Fix this bug asap Can you please make sure you set the File Guard to "Additionally scan all files when they are created or modified"? If adding the specific extension doesn't work for you, I would also suggest to disabling the "Only scan files with the following extensions" option completely. I use Chrome 100% and on advice of Fabian's post above I added .crdownload to the list. I tried to download Eicar.txt and it failed with the following screen shot EMSI seems to be working 100% for me... Win 7 X64 SP1 Thanks Steve. I have been an avid Chrome user since the very first beta and never had any such problems either on both Windows 7 x64 as well as Windows 8.1 RTM. Link to comment Share on other sites More sharing options...
Recommended Posts