1

We have a fairly standard commercial e-mail setup, we use Outlook and Exchange and have a very well known third party service providing spam & phishing filtering and virus and malware scanning.

I ran a test using the Kaspersky version of the EICAR standard file (for those who don't know EICAR is a standard test used to trigger your anti virus response without any risk of virus infection - more here Kaspersky EICAR)

The EICAR com file is compressed in a zip file which I attached to a mail and sent it to several people, all users received the mail with the attachment in tact and with no warning messages to the user and no alerts on the mail scanner log, the file just bypassed the scanner. On opening the attachment Microsoft Intune immediately responded and cleaned the 'virus'. For comparison, i sent the same email to my Gmail address which filtered out the message.

Are there any valid reasons that a mail virus scanner would not detect the EICAR file as a real virus and respond accordingly?

Improve this question
3
  • you're asking the wrong question, I think - the effect you want to ask about is the inspecting of zip archives and not about EICAR
    – schroeder ♦
    Jun 14, 2017 at 9:09
  • It is my understanding that the service does scan compressed files and has previously identified potential risks inside zip files.
    – iainpb
    Jun 14, 2017 at 9:11
  • Have you run further tests to confirm the behaviours? I have a feeling that your answer will be found through testing.
    – schroeder ♦
    Jun 14, 2017 at 9:15

2 Answers 2

Reset to default
2

The point of EICAR is that A-V programs will respond to it as though it were a real virus, it's of limited use if they don't.

What you're seeing here likely warrants some further investigation as @schroeder suggests in comments.

I'd recommend first trying sending EICAR without putting it in an archive. If it is found at that point it would appear that your scanner is not fully reviewing files inside archives, if it is not found at that point it appears that your scanner is either defective, or not triggering correctly on EICAR.

Improve this answer
5
  • This was the very first thing I tried, unfortunately the EICAR file is a com file which is immediately flagged as suspicious and stripped out by Exchange
    – iainpb
    Jun 14, 2017 at 9:22
  • 2
    @iain ahh you can generally include EICAR in a .txt file and decent A-V programs will still pick it up. It should be triggering on the string, so as long as the EICAR string is in there it should be picked up.
    – Rory McCune
    Jun 14, 2017 at 9:26
  • I have done the test as a plain text file and it did not trigger any antivirus response from the mail scanner or the local endpoint protection. I used the test string here en.wikipedia.org/wiki/EICAR_test_file in a standard windows txt file
    – iainpb
    Jun 14, 2017 at 9:34
  • 1
    that's interesting, I've had hits from A-V when uploading EICAR as a text file before and if I try to attach eicar.txt to a gmail message I instantly get "virus detected" in the compose window... It might be worth trying with gmail and see what you're getting there.
    – Rory McCune
    Jun 14, 2017 at 9:48
  • Gmail does indeed block receipt of the txt file and the zip file, and in fact won't even let you send the txt or zip file as an attachment, it detects a virus and prevents sending. Definitely something wrong with that mail scanning!
    – iainpb
    Jun 14, 2017 at 10:04
0

"Are there any valid reasons that a mail virus scanner would not detect the EICAR file as a real virus and respond accordingly?"

If the mail scanner doesn't have the abilities to unpack executable pack file, then EICAR file will be slipped under the radar.

AFAIK, email scanner from all major AV vendor (that submit their product to AVtest) has such capabilities. Nevertheless, there is no guarantee that the unpacker will work all the time, as the packer seller is making a living selling those tools "to protect customer proprietary code".

In addition, a malvertisement/spam mail may also play a simple social engineering trick. E.g. archive the EICAR and password protect the archive; put the password in the email and tell the user to enter it when it pops up during extraction. That's why besides email scanner, you need a typical AV scanner.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .