4 ms·
> ESATF is used to "check", so, in order to get a "full" checking, I think it should be treated like a true virus No, it shouldn't. EICAR is a special test-cas
by ZoFreX 15y ago
> ESATF is used to "check", so, in order to get a "full" checking, I think it should be treated like a true virus
No, it shouldn't. EICAR is a special test-case, and if it was detected heuristically then Hello, World! would also get flagged as a virus. Not helpful.
A better way to test heuristics in AV scanners would be to run a 6 month out of date antivirus program against viruses that have emerged in the last 6 months, and that is exactly what the heroes at AV Comparatives [1] do every year.
[1] http://av-comparatives.org/ http://av-comparatives.org/
- nodata 15y agoDirect link: http://www.av-comparatives.org/en/comparativesreviews/retrospective-test http://www.av-comparatives.org/en/comparativesreviews/retros...
- sp332 15y agoAgreed, this is bull. The program prints a single string - hardly threatening. It's not malicious in any way. There's no reason for a heuristic scanner to pick it up. The EICAR file itself is pretty interesting though: a pure-ASCII executable! http://mirror.href.com/thestarman/asm/eicar/eicarcom.html http://mirror.href.com/thestarman/asm/eicar/eicarcom.html