Author Topic: Eicar test file  (Read 5354 times)

0 Members and 1 Guest are viewing this topic.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31225
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Eicar test file
« on: May 23, 2004, 12:36:29 AM »
Avast is detecting the eicar test files perfectly, but I noticed that if I attaced the string to a excisting jpg file and scanned that file, Avast did not detect it. Is this the way it is supposed to be?

Offline Vlk

  • Avast CEO
  • Serious Graphoman
  • *
  • Posts: 11664
  • Please don't send me IM's. Email only. Thx.
    • ALWIL Software
Re:Eicar test file
« Reply #1 on: May 23, 2004, 12:45:18 AM »
Of course. From http://www.eicar.org/anti_virus_test_file.htm :

Any anti-virus product that supports the eicar test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters allowed are the space character, tab, LF, CR, CTRL-Z.
If at first you don't succeed, then skydiving's not for you.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31225
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Eicar test file
« Reply #2 on: May 23, 2004, 01:40:51 AM »
Thanks Vlk, I always was undere he impression AV software should react on it no matter where in a file it was or how long the file was. Learned something  new :D

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11811
    • AVAST Software
Re:Eicar test file
« Reply #3 on: May 24, 2004, 09:58:16 AM »
You are right, the length certainly shouldn't make any difference for most viruses.
Eicar, however, is a special case. This special restriction has been incorporated because some true viruses attached (or prepended, or somehow used) the Eicar test string to make them look like "Eicar - not a virus", even though they were really dangerous. To avoid these misdetection, Eicar detection has been restricted as Vlk posted.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67241
Re:Eicar test file
« Reply #4 on: May 24, 2004, 01:55:15 PM »
some true viruses attached (or prepended, or somehow used) the Eicar test string to make them look like "Eicar - not a virus", even though they were really dangerous.

Life is becoming dangerous  :'(
The best things in life are free.

Offline MikeBCda

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2248
Re:Eicar test file
« Reply #5 on: May 24, 2004, 07:38:01 PM »
I suppose the "impersonators" could use the size-and-location restrictions themselves -- but in that case (unless I've missed something) they'd be back to just Eicar itself, which of course is no hazard.
Intel Atom D2700, 2 gig RAM, Win 7 x64 SP1 & IE-11, Firefox 51.0
(default). 320 gig HD, 15Mb DSL, Win firewall, Avast 12.3.2280 free, SpywareBlaster, MBAM Prem., Crypto-Prevent