topic Eicar no longer in AV signatures? in General Topics

Eicar no longer in AV signatures?

santonic — Fri, 16 Oct 2015 09:36:28 GMT

Is Eicar testfile no longer blocked by PA? I've tried through 2 PA devices and on both occasions it arrived to endpoint station (where was blocked by endpoint AV).

On 8th September 2015 same configuration was still blocking it.

Yes, I am trying http version, I have AV on block etc.

Re: Eicar no longer in AV signatures?

PANUser-1234 — Fri, 16 Oct 2015 12:42:31 GMT

Had the same issue here. Problem is the current content version 533. If you roll back to 532 eicar gets blocked again. Problem was confirmed by TAC yesterday.

Re: Eicar no longer in AV signatures?

santonic — Fri, 16 Oct 2015 12:52:07 GMT

From all the possible days I choose to play with this today....

Thank you for the info!

Re: Eicar no longer in AV signatures?

dieter_b — Mon, 19 Oct 2015 10:07:58 GMT

I wonder if this has got to do with the fact that PA drops "old" vulnerability signatures from their database...

Re: Eicar no longer in AV signatures?

santonic — Mon, 19 Oct 2015 10:18:06 GMT

Yeah, was thinking the same. Guess we must visit Eicar more to refresh its status in database 🙂