1

Is it safe to keep a file containing the virus (binary?) code on your local machine without executing it? I am testing my application against malicious file uploads and and wondering if it's safe to actually upload this virus into my application and let it store in the upload folder.

  • If you want to test you can use the Eicar test file. It's harmless and should get detected. If not, your setup is missing something. – Thanathan Sep 3 '15 at 8:23
  • says Virus Download Blocked somehow.. – Shih-Min Lee Sep 3 '15 at 8:28
  • 1
    Yeah you need to download it with Internet Explorer or try to "Save Link to", because the browsers as well identify it as virus and stop the download. – Thanathan Sep 3 '15 at 8:53
5

A virus binary is just like any other file. If it's not executed, then it is just data.

Note that there are other possible avenues that a virus could be activated without your consent. For example, if your computer is set up to automatically display thumbnail from an image file, and the virus exploits a buffer overflow in the image parser of the thumbnail generator, so you can accidentally execute the virus just by opening the directory where the virus is located. As long as you know the activation vector of the virus though, and you avoid those, keeping a virus file in the filesystem should be fine.

You should use an EICAR file if you want to test virus detection:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.