Sniptools » Tips/Tricks

How to test your anti-virus tool

November 5, 2003 Views (14,636) /  Comments (18) /  Trackback (0) / Digg/Share


So you have an anti-virus tool. How can you test that it works?

This is a good question and it is wise to familiarize yourself with how your anti-virus software behaves when it detects a virus, before it really happens. One quick way to do this is to use the “EICAR” Anti-Virus Test File. This is a test file that will cause no damage to your system and still allow you to test if anti-virus tool is awake.

Here are some steps:

  1. Open a text editor (e.g. Notepad)
  2. Enter the following text in it:
    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
  3. Save the file as “EICAR.COM” on your desktop.
  4. Open DOS and try to execute this .COM file (or simply double-click the file on Desktop)

If your anti-virus software is working properly, it will warn you that a virus has been detected when you attempt to run the .COM file.

To be double-sure, zip this file, and then try double-clicking on the ZIP file to see if your AV tool recognized viruses inside ZIP files. You can also send this file to yourself as an attachment, just to verify if your AV tool has command of email cleanliness.

(207 Words | )

 
Possibly Related
Other stuff that may be of interest  
Comments
What readers have asked/said/added.

^1 Emmanuel said on January 15, 2004 8:41 PM:

This is neat stuff, didn’t know there was a file for this purpose! Can you now tell me how I can test my credit card validation script without trying out my own number? :P

^2 Cheryl:) said on May 22, 2004 1:01 PM:

How cool! It worked!! (Panda antivirus came through!) Thanks for the info! CherylSmilie

^3 don said on May 30, 2004 2:45 PM:

worked like acharm….this site is amazing

^4 Don Mynack said on July 1, 2004 1:01 PM:

Uh, I tried it and nothing happened. I use Norton AV. What do I do now?

^5 Shashank said on July 11, 2004 12:18 PM:

Don, I guess it’s time to ditch Norton AV and get a free but still quite decent tool like AVG. Microsoft now recognizes AVG in it’s recent SP2 update to Windows, so it’s a very respectable one. http://www.grisoft.com

HTH! Shanx

^6 Shahid Ali said on July 25, 2004 6:20 PM:

Hi!

I tried what U said. It’s amazing. I couldn’t beleive,Norton could do this. Norton detected the ‘infected file’ and deleted it. And it could also scan thru the zipped file. Also, I tried sending the infected file to myself as an e-mail attachment. To my surprise, the file couldn’t be attached in Yahoo. It said that the file was infected and it couldn’t be attached.

^7 Mary said on August 1, 2004 5:34 AM:

I couldn’t even try zipping it (“virus found!”), nevermind seeing if a zip would be scanned!

My virus scanner is AVG 6 (free) so if you don’t have a virus scanner, or a good one, try it out. Smilie
http://free.grisoft.com/freeweb.php/doc/2/

^8 Ariel said on January 10, 2005 6:12 AM:

I was unable to zip or attach without my virus software throwing up a warning. Am using Avast 4.5 Home Edition, incomparable freeware with steel door security, broad coverage, frequent updates, and easy interface. Go to www.avast.com

^9 Rav said on February 22, 2005 4:03 AM:

Ok, but how do I know my scanner will detect the most recent threats? Sure it picks up a know pattern but will it pick up the latest attack strategy though up by someone? Does anyone know where I can get a buch of infected files with the most recent viruses (real and active or just the signatures). Google doesn’t seem to be helping me today Sad :(

^10 Shashank said on February 22, 2005 4:05 PM:

Rav, for that you should probably use some good anti-virus tool (check out http://www.grisoft.com for instance) and leave the auto-update on. Then the tool will check periodically for updates to virus definitions and download them automatically. Almost all decent anti-virus companies offer this feature these days.

^11 Rav said on February 24, 2005 1:02 PM:

I do have AVG installed, Trend Micro before that. How do I know AVG will work when the time comes? Or any other one for that matter. Just becuase it detects some standard file created a few years ago does NOT mean it will protect me from something more recent. Are their any other standard tests that were developed say with in the last 6 months? I am not asking for a guarantee. When a new virus threat comes out it would be nice if a good samaritan would put out a pseudo infected file so we can see if the lates virus gets cuaght and identified by our scanners. Just a thought, something for the community to think about.

^12 BHARTHI said on April 21, 2005 4:21 PM:

how to delete and stop that ” osa.exe” file in startup ? cd rom drive ejecting problem. this problem is not a hardware problem. i thing this is virus problem. now i need the help what type of virus is hear that system?

^13 Shashank said on April 22, 2005 9:01 AM:

Bharathi, that’s the Microsoft Office startup utility. If you don’t mind some unexpected results with your MS Office functionality, there are a couple of ways of getting rid of it:

(1) You can download a utility called “Hijack This” — don’t let the name scare you, it is a very reliable and yet FREE tool. Run it and it’ll show you all the software/utilities that are loaded when your system starts up. Disable OSA.EXE or any others you don’t need.

(2) Or, just download Spy Sweeper, it also allows you to add and remove startup options. It’s not free but it’s a fantastic anti-worm tool in general.

^14 Jon said on June 12, 2005 1:50 PM:

Thats the coolest and easiest test I have ever done. AVG in my opinion and several others believe it is the best. Thanks for the test and I hope that who ever made that can put more tests to see if AVG proves that it is better than Norton

^15 Brian D'silva said on June 14, 2005 10:59 PM:

My Virus tools is not detecting this EICAR.COM file .Plz suggect me .

^16 Iain Shortreed said on October 10, 2005 10:44 AM:

The second i saved to my desktop i got a popup saying:

Real-time Scan
Trend Micro PC-cillin Internet Security has detected a virus, spyware application, or other Internet threat, and performed the action specified.

Infected file: C:\Documents and Settings\Administrator\Desktop\EICAR.COM
Virus name: Eicar_test_file
User name: Administrator
Scan action result: Unable to clean infected file. The file was quarantined.

—-
Yay :D

^17 liam said on December 11, 2005 5:16 AM:

it really worked well the moment i tryed to execute it avg popped up saying virus detected. that is really cool thanks.

^18 Bob said on April 4, 2007 12:34 PM:

This really made me feel safer with my virus software (Avira AntiVir http://www.free-av.com/ ). It actually detected right when I saved it (not even letting the program run; just knew that it was bad). It’s free, but it bugs you to upgrade to premium. I’d recommend it. Still blown away by how quick it was though…

 

Post a comment
Please be decent while posting comments, don't make us delete them, thanks.




Will be spam-protected.

Remember?


Comment Preview

XX said on :

 

Trackbacks
Ping @ http://sniptools.com/ping/2003-11/36. Listed below are links to weblogs that reference this article.

 

Referrals
*Some* places that viewers have come to this page from: