# Is your virus scanner working?



## knight_47 (Mar 15, 2006)

Use this very simple test to check weather your anti virus ads up to it's promise. This is a harmless virus, if you can even call it that, all it does is suppose to display "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!"

All you need to do is copy this line and paste it into a notepad file (Right click on your desktop, New > Text document)

*X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H**

Then save it, and close out. Did your anti virus detect anything??

I think it would be cool to share what you guys get, make sure you tell us what you're using.

I'm currently runing ZoneAlarm Security Suite version:6.5.737.000, and the instant I hit CTRL S, to save it, it detected it, and deleted it.


----------



## knight_47 (Mar 15, 2006)

I'm going to document all the scanners that do, and no not work, so please let me know what you guys get, and if you could, a screen shot would be nice. Thanks

You can view the documentation @ www.knight47.com/virustest.htm


----------



## Stoner (Oct 26, 2002)

AVG7 free here.
It was detected on a manual scan.


----------



## Wolfeymole (Jun 18, 2005)

What happens if it doesn't get detected?


----------



## Stoner (Oct 26, 2002)

Hi Wolfeymole........
It's a standard test to check if your av scanner works.
If it's not detected at all, then either your scanner wasn't programed to find it or there's something wrong with the scanner.

What's interesting for me, is I can detect it in a manual scan in notepad, but if I save it in Word 2000 or word pad, it doesn't recognize it as a virus.


----------



## knight_47 (Mar 15, 2006)

Wolfeymole said:


> What happens if it doesn't get detected?


What software are you using? Avast??

Stoner, Zone Alarm picked it up literally the second I hit Save. Interesting...


----------



## Stoner (Oct 26, 2002)

I've done this test before in 98se and another win2k install, all with AVG7.
They all responded the same.


----------



## knight_47 (Mar 15, 2006)

If it's not too bothersome, can I have a screen shot please?


----------



## Stoner (Oct 26, 2002)

knight_47 said:


> If it's not too bothersome, can I have a screen shot please?




No problemo 
The positive is for the notepad .txt file, the negative is for the word 2000 .doc file


----------



## knight_47 (Mar 15, 2006)

Stoner said:


> No problemo
> The positive is for the notepad .txt file, the negative is for the word 2000 .doc file


Thank you very much. I added your screen shot to the list of sites that worked (knight47.com/virustest.htm)


----------



## Stoner (Oct 26, 2002)

Glad to help out


----------



## iltos (Jun 13, 2004)

norton '05 deleted the txt file, but didn't find it in word even after requesting a virus scan


----------



## Stoner (Oct 26, 2002)

It would also be interesting to see the results of a downloaded text file with that string in it.
Some AV scanners do auto scans of downloaded files.


----------



## knight_47 (Mar 15, 2006)

iltos said:


> norton '05 deleted the txt file, but didn't find it in word even after requesting a virus scan


ZA didn't detect anything in a word document either. But I don't think the code compiles in a .doc file maybe?



Stoner said:


> It would also be interesting to see the results of a downloaded text file with that string in it.
> Some AV scanners do auto scans of downloaded files.


You can test it online via this link: www.knight47.com/test

It's the fake virus! I promise!!


----------



## Stoner (Oct 26, 2002)

I gave it a try.
I downloaded the file but nothing happened untill I ran the mouse over it and a warning popped up.
Here's a screen shot.


----------



## bearone2 (Jun 4, 2004)

Stoner said:


> I gave it a try.
> I downloaded the file but nothing happened untill I ran the mouse over it and a warning popped up.
> Here's a screen shot.


sorry but it makes no sense that it's picked up in notepad but not word.

i've used eicar for a long time and it's picked up right away by my av, no matter how i dress it up.


----------



## Stoner (Oct 26, 2002)

Wasn't caught in Wordpad, either.


----------



## knight_47 (Mar 15, 2006)

bearone2 said:


> sorry but it makes no sense that it's picked up in notepad but not word.
> 
> i've used eicar for a long time and it's picked up right away by my av, no matter how i dress it up.


but notepad can be used to write almost anything. A html file, a php file, a batch file, css, etc... You can't write these files in word.

What AV did you use for it to get picked up in a .doc file??

Thank's again for the screenshot Stoner.


----------



## WhitPhil (Oct 4, 2000)

Wordpad and Word are wrapping other characters into the string of text if you save as a DOC file. 

But, if you save as a TXT file, the AVs will detect it.


----------



## bearone2 (Jun 4, 2004)

knight_47 said:


> but notepad can be used to write almost anything. A html file, a php file, a batch file, css, etc... You can't write these files in word.
> 
> What AV did you use for it to get picked up in a .doc file??
> 
> Thank's again for the screenshot Stoner.


symantec

when i started using it sometime back it was a much shorter sequence of characters.

the string is text with characters.


----------



## Wolfeymole (Jun 18, 2005)

Ok let me get this right.
If I copied and pasted that code from the first post into Notepad and save it as a .txt file the av should pick it up yes?
I run AVG free edition version 7.1.0.406 and it found nothing, is it me or...............?


----------



## knight_47 (Mar 15, 2006)

Yes it should, but it's important to make sure you add only, the bolded text, nothing less, and nothing more. 1 letter will render the code useless.


----------



## Wolfeymole (Jun 18, 2005)

Here is a screenshot of the notepad file which I saved.
What might be the problem because as I say it found zero.


----------



## knight_47 (Mar 15, 2006)

Wolfeymole said:


> Here is a screenshot of the notepad file which I saved.
> What might be the problem because as I say it found zero.


That's really wierd, because Stoner is using AVG 7, and his copy found it.

Have you tried right clicking the file, and then click "Scan for viruses"


----------



## Kenny94 (Dec 16, 2004)

> Here is a screenshot of the notepad file which I saved.
> What might be the problem because as I say it found zero


It should work with AVG Anti-Virus. We played with this a few months ago with no problems..

http://forums.techguy.org/tech-tips-tricks/481798-test-your-anti-virus-software.html


----------



## Wolfeymole (Jun 18, 2005)

I right clicked and scanned Knight and sure enough it found it.
Vis:


----------



## valis (Sep 24, 2004)

avg found it straight away last time we did this.


----------



## WhitPhil (Oct 4, 2000)

Wolfeymole said:


> I right clicked and scanned Knight and sure enough it found it.
> Vis:


Which would appear to mean that your AV is not continually active.

Or, you have told it not to monitor TXT files. Which, is ok since a virus can't nestle it's way into a TXT file in such a way as to infect a system.


----------



## ferrija1 (Apr 11, 2006)

Remember this knight?  

http://webhelp.xenweb.net/EICAR.zip.exe


----------



## knight_47 (Mar 15, 2006)

ferrija1 said:


> Remember this knight?
> 
> http://webhelp.xenweb.net/EICAR.zip.exe


hehe, that was cool!


----------



## Tapeuup (Apr 6, 2005)

My NIS '05 detected it as soon as I saved it to desktop and deleted it.


----------



## rivincarn (Feb 19, 2003)

I saved it as an .exe file with notepad and avg 7 picked it up right away


----------



## SouthParkXP101 (Jun 2, 2006)

it was detected on AVG auto and manual


----------

