How to test for presense of antivirus?

Question

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't need to be harmful).

How do I test for antimalware presense, proper configuration and up-to-dateness? Where can I get malware for testing?

Answer 1

While you can do this yourself, I would argue that unless you are a malware researcher there is almost no value in running real malware through your antivirus solution. As @chutz answered, EICAR is useful to trigger A/V if you must but testing for it is almost pointless these days. If you have an AV solution, whether it be standalone or enterprise level, the only useful checks are:

• Is it turned on
• Is it set to scan on file open
• Is it set to scan on file receipt
• Is it set to run a full scan on a regular basis
• Are the signatures up to date

It is a pretty mature industry - leave the vendors to do the testing of their signatures. If it passes those checks I listed, that's about all you can ask for.

Answer 2

EICAR is commonly used for testing anti-virus installations.

Answer 3

Googling will show up various repositories of malware and technical analyses. Some of these are hosted by malware researchers - some by black hats themselves, so be very careful when checking these sites out.