3 ms·

How good are anti-virus heuristic scanners?

• ZoFreX 15y ago
  > ESATF is used to "check", so, in order to get a "full" checking, I think it should be treated like a true virus No, it shouldn't. EICAR is a special test-case, and if it was detected heuristically then Hello, World! would also get flagged as a virus. Not helpful. A better way to test heuristics in AV scanners would be to run a 6 month out of date antivirus program against viruses that have emerged in the last 6 months, and that is exactly what the heroes at AV Comparatives [1] do every year. [1] http://av-comparatives.org/ http://av-comparatives.org/
  • nodata 15y ago
    Direct link: http://www.av-comparatives.org/en/comparativesreviews/retrospective-test http://www.av-comparatives.org/en/comparativesreviews/retros...
  • sp332 15y ago
    Agreed, this is bull. The program prints a single string - hardly threatening. It's not malicious in any way. There's no reason for a heuristic scanner to pick it up. The EICAR file itself is pretty interesting though: a pure-ASCII executable! http://mirror.href.com/thestarman/asm/eicar/eicarcom.html http://mirror.href.com/thestarman/asm/eicar/eicarcom.html
• ordinary 15y ago
  8 year old post. Interesting, though.