hacker7 Posted September 20, 2017 Share Posted September 20, 2017 EICAR is a 68-byte .com file detected as "EICAR-Test-File". This IS NOT a virus. The test file simply displays a text message and returns the control to the operating system. Some time ago certain developers of antivirus software started adding such test files to their packages. Antivirus software detects it as a virus although it is not a virus. Such test “viruses” are designed to satisfy the curiosity of users who do not have “live samples” of a virus, but want to see the reaction of antivirus software to a virus detection (how it informs the user, what actions it prompts and etc.). Later antivirus software vendors came to an agreement about developing a uniform standard "virus simulator" which should consist of text messages only. The latter allows any user to create such a "virus" manually (for example, by copying it from the documentation). The resulting .com file looks like this: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* If you copy and paste this text or enter it by command "copy con test.com", and execute the resulting .com file, it will output the message EICAR-STANDARD-ANTIVIRUS-TEST-FILE! and return the control to the operating system. That's it. A lot of antivirus software will detect it as "EICAR-Test-File". Download eicar.zip from the Kaspersky Lab server. Source https://support.kaspersky.com/viruses/general/459 Link to comment Share on other sites More sharing options...
hacker7 Posted September 20, 2017 Author Share Posted September 20, 2017 Eset smart blocking it! Link to comment Share on other sites More sharing options...
Pete 12 Posted September 20, 2017 Share Posted September 20, 2017 Lots of anti-virus ignore this test-file , malwarebytes , Malwarebytes AntiRootkit , Hitman Pro, Windows Defender , etc. They just dont "see " this file , wonder what it means for these scanners , are they reliable enough.....................??? ESET , Zemana and Windows anti-malware ( monthly updated by MS) " captured " the file.............( makes me happy , coz using these good scanners !) btw; used Malwarebytes 2.2.1.1043 ( which did not found it) , someone tried to catch it with Malwarebytes 3.2.2 ( latest version )................?? Did this test again with latest Malwarebytes Premium 3.2.2.2029 ; did not found it either............!! btw ; what a dissappointing ( sh** ) result of Malwarebytes.....! Link to comment Share on other sites More sharing options...
pc71520 Posted September 21, 2017 Share Posted September 21, 2017 http://www.eicar.org/86-0-Intended-use.html X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* Link to comment Share on other sites More sharing options...
UmbraEmsisoft Posted September 21, 2017 Share Posted September 21, 2017 It is just a test file to see if the AV scanner is working or not. Link to comment Share on other sites More sharing options...
knowledge-Spammer Posted September 21, 2017 Share Posted September 21, 2017 no virus it make sure your av is working right Link to comment Share on other sites More sharing options...
Pequi Posted September 22, 2017 Share Posted September 22, 2017 It's 16 bit DOS. You can make the extension .com or .exe, and run it in DOSBOX - Well I can, I don't use a resident AV. It won't run under XP 32 bit (unless you tweak the registry) or Win > Vista, or Linux. I sometimes put it in my signature when I send messages ... makes people's AV's go crazy. Other than that, it's harmless. ;) Link to comment Share on other sites More sharing options...
Holmes Posted September 22, 2017 Share Posted September 22, 2017 Yes this is a test file to let you know your antivirus is doing what its supposed to be doing I have downloaded it before and used it I think its harmless. Link to comment Share on other sites More sharing options...
UmbraEmsisoft Posted September 22, 2017 Share Posted September 22, 2017 It is harmless, just like a cop is asking you to walk on a line to see if you are not drunk. Link to comment Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.