Test Your Anti-Virus Program With eicar

I had a client ask me an interesting question yesterday afternoon, in that they wanted to know if there was a safe way to test their anti-virus program. The eicar test virus has been around for many years and is a simple way to confirm that your AV program is in fact working. On the eicar site it states:

If you are active in the anti-virus research field, then you will regularly receive requests for virus samples. Some requests are easy to deal with: they come from fellow-researchers whom you know well, and whom you trust. Using strong encryption, you can send them what they have asked for by almost any medium (including across the Internet) without any real risk.

Other requests come from people you have never heard from before. There are relatively few laws (though some countries do have them) preventing the secure exchange of viruses between consenting individuals, though it is clearly irresponsible for you simply to make viruses available to anyone who asks. Your best response to a request from an unknown person is simply to decline politely.

A third set of requests come from exactly the people you might think would be least likely to want viruses “users of anti-virus software”.

They want some way of checking that they have deployed their software correctly, or of deliberately generating a “virus incident in order to test their corporate procedures, or of showing others in the organisation what they would see if they were hit by a virus”.

There’s also a disclaimer that you should take seriously as well:

Important note: EICAR cannot be held responsible when these files or your AV scanner in combination with these files cause any damage to your computer. YOU DOWNLOAD THESE FILES AT YOUR OWN RISK. Download these files only if you are sufficiently secure in the usage of your AV scanner. EICAR cannot and will not provide any help to remove these files from your computer. Please contact the manufacturer/vendor of your AV scanner to seek such help.

Though the test is simple to use, one should also be aware that this is no indication that your AV program will protect you against every virus. This is especially true if your AV program has not been updated with the latest protections.

Comments welcome.

Eicar Web site is here.