2

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't need to be harmful).

How do I test for antimalware presense, proper configuration and up-to-dateness? Where can I get malware for testing?

5

While you can do this yourself, I would argue that unless you are a malware researcher there is almost no value in running real malware through your antivirus solution. As @chutz answered, EICAR is useful to trigger A/V if you must but testing for it is almost pointless these days. If you have an AV solution, whether it be standalone or enterprise level, the only useful checks are:

  • Is it turned on
  • Is it set to scan on file open
  • Is it set to scan on file receipt
  • Is it set to run a full scan on a regular basis
  • Are the signatures up to date

It is a pretty mature industry - leave the vendors to do the testing of their signatures. If it passes those checks I listed, that's about all you can ask for.

  • It seems that I can test for 1-4 using EICAR testfile. But how do I test for up-to-dateness of signatures? – Andrei Botalov May 22 '12 at 20:58
  • 2
    You don't bother testing it, you get the a/v to check for latest signatures. – Rory Alsop May 22 '12 at 21:19
3

EICAR is commonly used for testing anti-virus installations.

  • 4
    Note that EICAR is only really good for checking whether the antivirus software works at all. It doesn't really do much to tell you whether it is up to date, or will catch newly-released viruses. – Iszi May 22 '12 at 16:36
  • I personally wish that EICAR had a "respond if DAT file newer than X date" feature. – goodguys_activate Jul 1 '12 at 2:27
1

Googling will show up various repositories of malware and technical analyses. Some of these are hosted by malware researchers - some by black hats themselves, so be very careful when checking these sites out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.