To find out whether the local SEP client is scanning on modification only or when a file is accessed or modified, do the following:
- Go to File System Auto-Protect
- Go to Advanced
- In the section Scan files when you will find the following options:
- Scan when a file is accessed or modified
- Scan when a file is modified
- (Scan when a file is backed up)
If you have enabled Scan when a file is modified
the SEP client actually does what the setting says: it only scans the file when modified.
If you want to change this behaviour, change the setting to Scan when a file is accessed or modified
NOTE: the safer setting is to Scan when a file is accessed or modified!
Executing (running) a file (e.g. the antivirus test file) is considered to be accessing the file, and for eicar.com this is possible if Scan when a file is modified
A copy is considered to be a modification. Therefore a copy of an antivirus test file is never possible with Auto-Protect enabled, regardless of the accessed/modified option.
(The DOS box however shows “1 file(s) copied.”, so that is a bit confusing.)
A Scheduled Scan or a Manual Scan will find the antivirus test file, regardless of your settings for accessed/ modified.