Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't need to be harmful).

How do I test for antimalware presense, proper configuration and up-to-dateness? Where can I get malware for testing?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

While you can do this yourself, I would argue that unless you are a malware researcher there is almost no value in running real malware through your antivirus solution. As @chutz answered, EICAR is useful to trigger A/V if you must but testing for it is almost pointless these days. If you have an AV solution, whether it be standalone or enterprise level, the only useful checks are:

  • Is it turned on
  • Is it set to scan on file open
  • Is it set to scan on file receipt
  • Is it set to run a full scan on a regular basis
  • Are the signatures up to date

It is a pretty mature industry - leave the vendors to do the testing of their signatures. If it passes those checks I listed, that's about all you can ask for.

share|improve this answer
    
It seems that I can test for 1-4 using EICAR testfile. But how do I test for up-to-dateness of signatures? –  Andrey Botalov May 22 '12 at 20:58
2  
You don't bother testing it, you get the a/v to check for latest signatures. –  Rory Alsop May 22 '12 at 21:19

EICAR is commonly used for testing anti-virus installations.

share|improve this answer
4  
Note that EICAR is only really good for checking whether the antivirus software works at all. It doesn't really do much to tell you whether it is up to date, or will catch newly-released viruses. –  Iszi May 22 '12 at 16:36
    
I personally wish that EICAR had a "respond if DAT file newer than X date" feature. –  makerofthings7 Jul 1 '12 at 2:27

Googling will show up various repositories of malware and technical analyses. Some of these are hosted by malware researchers - some by black hats themselves, so be very careful when checking these sites out.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.