1

Does the EICAR antivirus test work on antivirus scanners for Linux? The EICAR test is described in more detail here: http://en.wikipedia.org/wiki/EICAR_test_file

The reason I ask is that it requests the EICAR file to be a .COM file, which is specific to Microsoft as far as I am aware. Should Linux antivirus software still pick this up though since it is a standardized test?

Improve this question

2 Answers 2

Reset to default
2

Yes Linux AV such as Sophos check for and find EICAR. EICAR is a test file with a known signature used to establish the fact that your signature-based AV is working. Many certifiers require a positive result for that test.

Improve this answer
0
1

EICAR is so simple it doesn't need any Windows COM files or anything !

Have you actually looked at the EICAR code ? Its all self contained in one tiny file.

As for

why would Linux antivirus need to look for a Windows virus?

Lots of people use Linux machines as servers (mail,web,file etc.) ... all of which may serve Windows clients. Seems fairly obvious to me why you would want an AV scanner with a decent detection library.

Quite frankly, I would publicly name and shame any anti-virus software that only detects linux "viruses" ... it would be a waste of space and resources on your Linux machine.

Improve this answer
3
  • The .COM file is the EICAR test itself (name it eicar.com). As quoted from the Wikipedia article: The file is a text file of either 68 or 70 bytes that is a legitimate executable file called a COM file that can be run by Microsoft operating systems and some work-alikes (except for 64-bit due to 16-bit limitations), including OS/2.
    – Jonathan
    Aug 4, 2014 at 17:32
  • Yes,but you worded your question as if it relied upon third-party COM files. That's the point I was making. In the end, a COM is nothing but compiled code, which in the case of EICAR is likely to look very similar in source form, as you can see on the EICAR website.
    – user3083
    Aug 4, 2014 at 17:33
  • 3
    "COM", in this case, does not refer to the "component object model". Rather, it refers to the "command" executable file format, a very simple program format used in the MS-DOS days. This is how the EICAR code can be made so small: it doesn't need a PE header or anything.
    – Mark
    Sep 13, 2014 at 1:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .