You can use the EICAR anti-virus test files to test that your anti-virus program is working properly.
[re-formatted for clarity]
quote:
This test file has been provided to EICAR for distribution as the "EICAR Standard Anti-Virus Test File," and it satisfies all the criteria listed above. It is safe to pass around because it is not a virus, and it does not include any fragments of viral code. Most products react to it as if it were a virus (though they typically report it with an obvious name, such as "EICAR-AV-Test").
The file is a legitimate DOS program, and it produces sensible results when run (it prints the message "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!").
...[snip]...
You are encouraged to make use of the EICAR test file. If you are aware of people who are looking for real viruses "for test purposes," bring the test file to their attention. If you are aware of people who are discussing the possibility of an industry-standard test file, tell them about www.eicar.org and point toward this article.
In order to facilitate various scenarios, we provide 4 files for download:
1. The first, eicar.com, contains the ASCII string as described above.
2. The second file, eicar.com.txt, is a copy of this file with a different filename. Some readers reported problems when downloading the first file, which can be circumvented when using the second version. Just download and rename the file to "eicar.com." That will do the trick.
3. The third version contains the test file inside a zip archive. A good anti-virus scanner will spot a "virus" inside an archive.
4. The last version is a zip archive containing the third file. This file can be used to see whether the virus scanner checks archives more than only one level deep.
Once downloaded, run your AV scanner. It should detect at least the file "eicar.com." Your AV monitor may not even let these files be downloaded.
Good scanners will detect the "virus" in the single zip archive and may be even in the double zip archive.
Once detected, the scanner might not allow you any access to the file(s) anymore. You might not even be allowed to delete these files. This is caused by the scanner putting the files into quarantine. The test file will be treated just like any other real virus infected file. Read the user's manual of your AV scanner on what to do or contact the vendor/manufacturer of your AV scanner. You might not be able to directly delete the files. You may have to tell your AV scanner or monitor to delete or quarantine them for you, or your scanner or monitor may automatically delete or quarantine the files. It is worth looking this up in the help or manual of your AV product now, rather than when you encounter a real virus.
Important note: EICAR cannot be held responsible when these files or your AV scanner in combination with these files cause any damage to your computer. You download these files at your own risk. Download these files only if you are sufficiently secure in the usage of your AV scanner. EICAR cannot and will not provide any help to remove these files from your computer. Please contact the manufacturer/vendor of your AV scanner to seek such help.
The files, and the instructions for using them, are here; just scroll down to the "Download area":
»www.eicar.org/anti_virus_test_file.htm (www.eicar.org)
All BBR Security FAQs"
The BBR Security Forum
 feedback form
 feedback form
by keith2468  edited by JMGullett
last modified: 2007-06-13 12:34:39 |
