I'm posting this here since programmers write viruses, and AV software. They also have the best knowledge of heuristics and how AV systems work (cloaking etc).

The EICAR test file was used to functionally test an antivirus system. As it stands today almost every AV system will flag EICAR as being a "test" virus. For more information on this historic test virus please click here.

Currently the EICAR test file is only good for testing the presence of an AV solution, but it doesn't check for engine file or DAT file up-to-dateness. In other words, why do a functional test of a system that could have definition files that are more than 10 years old. With the increase of zero day threats it doesn't make much sense to functionally test your system using EICAR.

That being said, I think EICAR needs to be updated/modified to be effective test that works in conjunction with an AV management solution. This question is about real world testing, without using live viruses... which is the intent of the original EICAR.

That being said I'm proposing a new EICAR file format with the appendage of an XML blob that will conditionally cause the Antivirus engine to respond.

<?xml version="1.0"?>

In this sample, the antivirus engine would only alert on the EICAR file if both the signature or engine file is equal to or newer than the valid-from date. Also there is a passcode that will protect the usage of EICAR to the system administrator.

If you have a backgound in "Test Driven Design" TDD for software you may get that all I'm doing is applying the principals of TDD to my infrastructure.

Based on your experience and contacts how can I make this idea happen?

  • Sorry, to me this question is offtopic. Software development includes testing, but that does not make everything testing-related relevant to software deleopment. Feb 17, 2011 at 13:58

2 Answers 2


As you said in the question, it would have to work in conjunction with an AV solution. In order for that to happen you would either need to write an AV engine, or become involved with an existing AV vendor.

If such a thing did exist... Where does the benefit come in? Just thinking devil's advocate here.. Couldn't the AV engine just report when it's database was updated?

  • I'm just focusing on functional testing. It's not always the case the tester owns the management console, or the management machine is configured and up to date. Sometimes the machine in question may be accidentally excluded from management. Sep 9, 2010 at 18:48

There already are products that do that. But they require detailed knowledge:

  • what AV product exists
  • what versions are available
  • which of those versions are up to date
  • what detection identities are available
  • which of those should be installed on an up to date system

And the way to understand all of that depends very much on the AV vendor. So you tend to find the functionality is restricted to the AV vendor's console, or to patch management companies who have large collections of employees who do nothing other than find out what software is up to date.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.