EICAR Test File - Trend Micro

t_test_eicar_file

EICAR Test File

The European Institute for Computer Antivirus Research (EICAR) has developed a test virus to test your antivirus appliance. This script is an inert text file. The binary pattern is included in the virus pattern file from most antivirus vendors. The test virus is not a virus and does not contain any program code.

• Never use real viruses to test your Internet security.

Download the EICAR test virus from one of the following URLs:

• http://www.eicar.org/download/eicar.com.txt

Alternatively, you can create your own EICAR test virus by typing or copying the following into a text file, and then naming the file eicar.com:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

• Flush the local browser cache before testing. If the local browser cache contains a copy of the test virus, it is possible an attempt to download the file would get the file from the cache, rather than getting it from the Internet, and Deep Edge would not detect the file.

To test for virus scanning:

1. Log on to the Deep Edge web console.

2. Click Policies > Rules > Add New.

3. Type a Policy Name and Description.

4. Check the Enable and Enable log check boxes.

5. Click the Action tab. Set the action to Allow with Inspection. Click OK.

6. For the same policy, click the Profile tab and set the Anti-Malware profile to the Default Profile, and the WRS profile to the Default Profile.

7. Click URL Filtering Profile > Add New.

8. Add a new URL Filtering Profile with the following steps:

• Type a Name and Description.

• Click Adult in the URL filtering category.

• Click All in the Adult URL filtering rules to select all.

• Click OK.

9. In the Profile tab, choose the newly added URL Filtering profile.

10. Click OK and click Apply at the top of the page.

11. Use a test client to access the following website and download a test virus:

http://www.eicar.org/download/eicar.com.txt

12. Use a test client machine to access the following website twice:

http://wrs21.winshipway.com

13. Use a test client machine to access the following website twice.

ca06-3.winshipway.com

14. Wait 30 seconds and go to Logs & Reports > Log Query > Violation Log.

15. Go to Policy > Rules.

16. Delete the added policy, click OK, and then click Apply.

See also:

• Testing Web Reputation

• Testing Application Control

• Testing URL Filtering

Copyright © 2003-2012 Trend Micro Incorporated. All rights reserved