Talk:EICAR test file
From Wikipedia, the free encyclopedia
Contents |
[edit] Confirmed successes and failures
Please give the date (preferably in a signature) and nature of the scan (i.e. plaintext, encrypted, hdd, email, ...). Be sure to fully update your software so that your signed date is accurate.
- Doesn't this violate Wikipedia's policy on No Original Research? --DragonHawk 20:39, 1 July 2006 (UTC)
- Yes, but not badly, and at least the results are verifiable. Btw, "McAfee Total Protection for Small Businesses" obliterated the thing without giving me a chance to tell it not to. Stevage 13:48, 9 August 2006 (UTC)
[edit] Successes
- NOD32 string saved as a plaintext or .com file. -- malo (tlk) (cntrbtns) 03:53, 28 June 2006 (UTC)
- ClamWin 0.88.2.3 recognizes all four test files downloadable at [1] 74.132.209.231 18:08, 28 June 2006 (UTC)
- AntiVir version 7, when saved as a .com file -- malo (tlk) (cntrbtns) 20:26, 28 June 2006 (UTC)
- Avast! 4.7, only .com file during an active scan. -- malo (tlk) (cntrbtns) 20:26, 28 June 2006 (UTC)
- BitDefender version 8, plaintext and .com files -- malo (tlk) (cntrbtns) 20:26, 28 June 2006 (UTC)
[edit] Failures
- Grisoft AVG Anti-Virus doesn't appear to recognize the string, even in plaintext. 74.132.209.231 03:02, 28 June 2006 (UTC)
- ClamWin 0.88.2.3 doesn't appear to recognize the string when copy/pasted into a text editor (used UltraEdit). 74.132.209.231 17:55, 28 June 2006 (UTC)
- AntiVir version 7, when saved as a plaintext file -- malo (tlk) (cntrbtns) 20:26, 28 June 2006 (UTC)
- Avast! 4.7, plaintext completely unrecognized. -- malo (tlk) (cntrbtns) 20:26, 28 June 2006 (UTC)
[edit] Why do they detect it?
The one thing this article doesn't tell me is *why* AV programs pick it up. Are they specially taught to recognise this string, or is there something inherently "virus-like" in the file? When you think about it, since the file *is* benign, there's no particular reason they should do anything about it. It's like calling the fire brigade to tell them you're about to set off the fire alarm, then complaining when they don't show up. Stevage 13:48, 9 August 2006 (UTC)
- It's more like holding fire drills, or testing your smoke alarm -- without starting a fire. Detecting the file means that your virus scanner is probably working properly. Furthermore, there's the possibility of testing your virus scanner's capability to detect viruses in compressed files, for example, without having to get an actual virus and then get your virus scanner to check it. You may want to use the Wikipedia:Reference desk for questions like this in future. Dysprosia 07:21, 10 August 2006 (UTC)
-
- Reference desk? No, the article should explain more about how it works. heqs 14:33, 23 October 2006 (UTC)
-
-
- The above guy has a point. If he still had to ask questions about basic information then this article needs expanding. The Kinslayer 12:26, 10 January 2007 (UTC)
-
[edit] It makes use of self-modifying code
- It makes use of self-modifying code to work around technical issues that this constraint makes on the execution of the test string.
What does this sentance mean? Regards, Ben Aveling 05:17, 28 November 2006 (UTC)
