5

Is there a modern version of the EICAR test file? Something lika a 64 bit EXE?

The old 16 bit COM file doesn't even run on modern systems.

I usually use some benign file that is detected anyway, like netcat or VNC, but a standard one would be better IMO.

Addition:

Some background: a while ago I experimented with some file permission settings that hid the file from most AV scanners (they fixed this hole since) but still allowed it to be executed. For this test a file that can be actually executed is needed. As EICAR is unfit for this, I used, IIRC, the bo2k exe file.

Following the the logic of some comments and answers (it does not need to run, just should be detected), why have a COM file at all? A simple TXT file containing EICAR-STANDARD-ANTIVIRUS-TEST-FILE would do the same job.

David Balažic
  • 179
  • 1
  • 10
  • 3
    AFAIK, COM is still sufficient to test a malware scanner, no need for an exe. – Yorick de Wid Aug 29 '16 at 11:20
  • 1
    @ You can write a C program with a EICAR test string hardcoded and used in printf and compile it – Sravan Aug 29 '16 at 11:21
  • 4
    @Sravan: actually no: It is clearly defined that at most a few white space bytes after the virus itself should be accepted. Thus any antivirus which just detects the test string somewhere inside some file has a broken signature. – Steffen Ullrich Aug 29 '16 at 11:23
  • 3
    Why do you want a modern one? Why does it need to run? – schroeder Aug 29 '16 at 11:38
  • @SteffenUllrich I didn't know that previously. Thank you :) – Sravan Aug 29 '16 at 12:00
  • 3
    @Sravan: you are not the only who does not know this. Several commercial products fail this requirement too. But it is explicitly stated: "The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters allowed are the space character, tab, LF, CR, CTRL-Z. " - http://www.eicar.org/86-0-Intended-use.html – Steffen Ullrich Aug 29 '16 at 12:22

1 Answers1

9

There is no reason the test virus should run. Nobody expects that an antivrus is doing behavioral analysis on this file because it actually does nothing bad. All what is expected is that even the stupidest antivirus without any current pattern is able to detect this file so that one can check if the antivirus is running at all or that a firewall is able to extract potentially malicious payloads from the traffic.

Steffen Ullrich
  • 201,479
  • 30
  • 402
  • 465
  • I saw systems detecting this dead COM file and not detecting real infected EXE files (with malware that is in their signature database), so it is important. It like saying "if police detects people who wear a great 'I am a criminal' sign, that is good enough". It is not. – David Balažic May 27 '17 at 13:49
  • Also, an EICAR file inside a container on a Windows system is not detected. The same goes for any other file inside the Windows Subsystem for Linux virtual disk. However, WSL interop means that files inside those containers still execute with the Windows host user permissions, as Windows executables. It would be nice to be able to test whether or not the Windows host AV will detect a threat inside the container when executed, even if it can't detect the file-based signature. So it follows that it would be nice-to-have that a benign EICAR-type file could be executed. – NotTheDr01ds Apr 15 '21 at 22:45