have you cleared your browser cache before testing? In almost all cases i've seen so far it was cached in the client, and therefore it seemed like the ASG didn't block the file.
Both engines should block eicar (and they did the last time i've tested). A common problem is also having an exception configured which causes virus scanning to be skipped for that file...
If the file is still not blocked, it would also be helpful to see the http proxy logfile.
Thanks. It turned out the issue was the client's computer wasn't going through the proxy. I found I indeed do have to block port 80 traffic to force people through the proxy.
