Hiya! That was done QUITE deliberately as we’d intended to add “file detection” to BOClean and because people had complained that we didn’t detect EICAR on the “drag and drop” thing, we added that FILE-ONLY sig as a “courtesy.” Eicar is designed as a file sig for testing, and even though you can execute it to display the text message within, it doesn’t DO anything or call ANY API functions that can do much of anything. Simply put, it’s a “hello world” print to screen application and nothing else. As a result, there is no memory signature for that AV test file … but since people insisted on dragging and dropping it, we did create a “file sig” for it and thus, BOClean does what I designed it to do WRT that particular file. Some so-called “AT tests” included the EICAR thingy so we had to at least include a detect as a file for it. But it runs for too short a time, does nothing, and is not a threat at all so I personally never felt the need to add a file hook there to BOClean which might interfere with an AV doing its job. In fact a LOT of BOClean’s “holdoffs” were done DELIBERATELY so as to let an AV do its thing and ONLY if the AV failed to catch it, would WE step in a few milliseconds later. And for our “get along” design, we’ve been dissed MANY times. 