Test your AV

[Paul Adams]

AV: avast! 4.6 (x64 version)

.COM save results:
Detected automatically YES/NO: YES
At point: Instantly on clicking the link in both IE and Firefox
Action: Audible alert and popup "a virus has been detected", file was not committed to disk, event was written to "Antivirus" event log

.ZIP save results:
Detected automatically YES/NO: YES
At point: Instantly on clicking the link in both IE and Firefox
Action: Audible alert and popup "a virus has been detected", file was not committed to disk, event was written to "Antivirus" event log

(Repeated .ZIP test with "eicarcom2.zip" and it detected the zipped zip file containing the virus too.)

[Jonny M]

AV: Symantec AntiVirus 10.1

.COM save results:
Detected automatically YES/NO: YES
At point: When "save" or "run" was selected in Internet Explorer.
Action: IE gave an error "Access Denied" and SAV popped up to tell me it had detected a virus. Event written into event viewer.

.ZIP save results:
Detected automatically YES/NO: NO
Action: When extracted to my desktop, SAV detected the virus and deleted it. Event written to event log.

[Flibb]

AV: avast! 4.6 home edition (free)

.COM save results:
Detected automatically YES/NO: YES
At point: Instantly on clicking the link in Avant
Action: Audible alert and popup "a virus has been detected", file was not committed to disk, event was written to "Antivirus" event log

.ZIP save results:
Detected automatically YES/NO: YES
At point: Instantly on clicking the link in Avant
Action: Audible alert and popup "a virus has been detected", file was not committed to disk, event was written to "Antivirus" event log

[Skinleech]

NOD32 64 bit edition v 1.1217 on Windows XP 64 via Deerpark Alpha 1.0+ X64@

14/09/2005 18:36:51 AMON file C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\s30e82q7.com Eicar test file quarantined - deleted

14/09/2005 18:36:31 IMON archive http://www.eicar.org/download/eicarcom2.zip Eicar test file Connection terminated

14/09/2005 18:36:27 IMON archive http://www.eicar.org/download/eicar_com.zip Eicar test file Connection terminated

14/09/2005 18:36:24 IMON file http://www.eicar.org/download/eicar.com.txt Eicar test file Connection terminated

14/09/2005 18:36:20 IMON file http://www.eicar.org/download/eicar.com Eicar test file Connection terminated

[Byatt]

FreeAV

.COM detectected automatically: YES
At point - when clicked on link

.ZIP detected automatically: NO
Detected as soon as it was unzipped, however.

[Atomic]

McAfee Virusscan Enterprise 8
Scan Engine : 4400
Virus Definitions : 4581

.COM save results:
Detected automatically YES/NO: YES
At point: As soon as file had finished downloading
Action: "Virus detected" message popped up , file Deleted as Virusscan decided it wasn't cleanable.

.ZIP save results:
Detected automatically YES/NO: YES
Detected when file was opened: Wouldnt let me open the archive as it was infected.
Detected when infected file was extracted to the disk: Yep straight away.

Manually detected when scanned: YES

[luap.h]

I found the same with Opera8 and NOD32, the zip within a zip wasn't detected

[nvening]

Well, i dont know how to get that log thing but AVAst did not let me save or unzip them

[muddyfox470]

Here is my result:

AV: Avast Pro 4.6.591

.COM save results:
Detected automatically YES/NO: YES
At point: Before downloading the file
Action: Audible alert and popup "a virus has been detected", file was not committed to disk, event was written to "Antivirus" event log

.ZIP save results:
Detected automatically YES/NO: NO (didn't wait at all)
Detected when file was opened: NO
Detected when infected file was extracted to the disk: Only when i clicked to check the file did it get recognised, although as it was a new install of the AV i was running a thorough scan in the background, so that could have put it off a bit? But it didnt warn me before downloading, like the other one.
Manually detected when scanned: YES

[Clingy]

Kaspersky Anti-Virus for Windows Workstations 5.0.200 - Max Protection setting.

.COM save results:
Detected automatically YES/NO: YES
At point: Instantly on clicking "Save to Disk"
Action: In standard Max Protection Settings Auto Disinfect. I had changed it to prompt user...disinfect, delete, skip....to see how quickly it reacted.

.ZIP save results:
Detected automatically YES/NO: NO
Detected when file was opened: NO
Detected when infected file was extracted to the disk: YES
At point: Instantly on extracting file
Action: In standard Max Protection Settings Auto Disinfect. I had changed it to prompt user...disinfect, delete, skip.
This is with "scan self-extracting achives" set correctly.

[yamangman]

F-Prot Antivirus 3.14e

.COM save results:
Automatically detected upon download request, warning displayed, access prevented.

.ZIP save results:
Automatically detected upon download request, warning displayed, access prevented.

.ZIP in .ZIP save results:
Automatically detected upon download request, warning displayed, access prevented.

[ikonia]

so based on these very interesting results, would anyone care to draw some conclusions/summary/thoughts

I've got my own views based on these results, but I'm interested in the views of others now that a god few results have been posted.

[badass]

A quick warning to people here - just because your AV detects the Eicar test virus does not mean your AV is up to scratch. It is very easy to detect and your definitions can be years out of date and it will still work.
What it does do is prove that your scanner is scanning in the right places. I have used it a few times before to test email scanning etc and fo that its also great

[Paul Adams]

A quick warning to people here - just because your AV detects the Eicar test virus does not mean your AV is up to scratch. It is very easy to detect and your definitions can be years out of date and it will still work.
What it does do is prove that your scanner is scanning in the right places. I have used it a few times before to test email scanning etc and fo that its also great

Seconded, this is to verify in what ways your AV will pick up viruses, how it will deal with them and alert you - it is not intended to give an indication as to which engine detects the most or has its signatures updated quickly or most frequently.

EICAR is not meant to be "easy" to detect, it is meant to be guaranteed to be detected to prove your AV is functional (which is why it scared the hell out of me when Sophos failed to pick it up a few years ago when I was testing a reconfiguration of a mail server).

It has been enough to deter me from using AVG (Free) after its failure to react quickly enough when an infected file has been committed to the disk and switch to Avast! on both the 32-bit and 64-bit platforms of Windows.

[Moby-Dick]

2 very good points.

Its made me have thoughts about using AVGfree too. Can someone test it with the full version of AVG ? ( its a product I used to like form an admin point of view and I'd hate to take it off my mental "preferred apps" list ).

Last time I tried avast! I wasn't overly impressed with certain parts of it. Some of the other apps have given me useful food for thougt.

[Vimeous]

Here is my result:

AV: Trend Officescan Corporate Edition 5.58 (Old Vn); Pattern: 2.845.00; Engine: 7.510

.COM save results:
Detected automatically YES/NO: YES
At point: > 1 second - appeared before IE download warning window appeared!
Action: Message Box stated:

Type: Real-time scan
User: ***
Infected file: C:\ ........(file in temporary internet files)
Virus name: Eicar_test_file
Action: Virus successfully detected, cannot perform the Clean action (Quarantine)

Also product itself popped-up giving similar details and suggesting references to virus help.

.ZIP save results:
Detected automatically YES/NO: YES (waited 7 minutes)
At point: [i]> 1 second - appeared before IE download warning window appeared![/B]
Action: Message as above x3.
However the main program this time listed 3 virus files, two com files inside the zip and the zip itself

Manually detected when scanned: Didn't get that far!