~*~ how to test your anti virus ~*~

Discussion in 'Software Q&A' started by jrkraj, Sep 13, 2006.

Thread Status:
Not open for further replies.
  1. jrkraj

    jrkraj New Member

    Joined:
    Sep 11, 2006
    Messages:
    33
    Likes Received:
    1
    Trophy Points:
    0
    Location:
    some where in Internet
    WARNING: This web page contains links to files that contain a harmless test file which virus detectors are programmed to treat as a virus. If you receive alerts from your anti-virus software, do not be alarmed. Read on, to discover what is happening.


    Creating a test virus

    Have you ever wondered if your anti-virus software is really working? Would you like to see what happens when it detects a virus? Here's a safe way to test your computer's virus protection that doesn't require you to have a real virus.

    First, open Notepad. Then copy and paste into it the text on the line below. (It should all be on one line.)

    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

    Then select File, Save, select All Files for the file type, then save the file as eicar.com. The result should look exactly like the screenshot below:

    [​IMG]

    Your anti-virus software may prevent you from saving the file as eicar.com, which is a sign that it is working effectively. If it doesn't raise an alert, try scanning the folder where you saved eicar.com. To see what happens if you try to run a file containing a virus, double-click eicar.com to open it.



    Explanation

    The file eicar.com you have created is completely safe. It is not a virus. It is a standard test file developed by the European Institute for Computer Anti-virus Research (EICAR). All anti-virus products are programmed to detect this file as if it was a real virus. Therefore you can safely use it to test whether your anti-virus software works, without fear of infecting your computer.

    If your anti-virus product should fail to prevent you from running the file, it will simply display the text "EICAR-STANDARD-ANTIVIRUS-TEST-FILE" in a DOS box. No harm will have been done, but you should probably consider using a better anti-virus product, because if it had been a real virus, your computer would by now be infected!
     
  2. nishant_nms

    nishant_nms New Member

    Joined:
    Sep 5, 2005
    Messages:
    1,344
    Likes Received:
    1
    Trophy Points:
    0
    Location:
    Pune
    My avast recognized it during saving it and asked to delete it immediately and deleted it sucessfully
     
  3. The Outsider

    The Outsider Beneath The Eyelids

    Joined:
    Aug 13, 2006
    Messages:
    289
    Likes Received:
    1
    Trophy Points:
    0
    Threat :
    Eicar Test File
    Comment :
    Event occurred on a new file created by the application: C:\WINDOWS\system32\notepad.exe. The file was moved to quarantine. You may close this window.

    thats what my nod32 said when i tried to save the file, thx for the info.
     
  4. anandk

    anandk Distinguished Member

    Joined:
    Mar 8, 2005
    Messages:
    3,786
    Likes Received:
    106
    Trophy Points:
    0
    Location:
    Pune
    thanx for the detailed info !

    all good av's (not sure about ca though) know about this 'threat'. in fact some of them even have a special msg for this one stating that 'testvirus eicar detected and quarantined'...so just bcoz an av detects this one dznt mean u r safe :)

    the test of av lies in protecting ur pc against zero day threatsor attacks...thats where heuristics and behaviour-based protection score...
     
  5. Ramakrishnan

    Ramakrishnan The Researcher

    Joined:
    Mar 7, 2006
    Messages:
    1,154
    Likes Received:
    10
    Trophy Points:
    38
    Location:
    Mumbai
    Even using ctrs in VBA is caught by anti-virus as threatening activity.
     
  6. Third Eye

    Third Eye gooby pls

    Joined:
    Apr 2, 2006
    Messages:
    4,293
    Likes Received:
    58
    Trophy Points:
    48
    Location:
    Not very far from you
    my avg recognized it....thnaks for this info.
     
  7. ~Phenom~

    ~Phenom~ The No.1 Stupid

    Joined:
    May 17, 2005
    Messages:
    1,703
    Likes Received:
    5
    Trophy Points:
    0
    Location:
    CYBERYARD
    My AV detected and deleted it . It was posted earlier also , around 6 months back.
     
Thread Status:
Not open for further replies.

Share This Page