up vote 0 down vote favorite
share [g+] share [fb]

Is there any antivirus test program like EICAR for 64 bit Windows?

I'm trying to check my antivirus protection downloading the EICAR test program as usual. The antivirus pops up an alert on the download (that's ok), but I cannot run the EICAR.COM program because it's an 16-bit program and I'm running Win7 64bit.

I can run the program on DosBox but it's not the same thing as running it directly from the OS.

link|improve this question
30% accept rate
feedback

3 Answers

up vote 0 down vote

Even though you cannot get your 64bit OS to launch the com file the AV scanner should still catch it. Even if you did get the com file on a 32 bit pc it would actually execute as it isn't a valid com file anyways.

The reason for the various file types is that some scanners are set to only scan certain file types, thou non of the executable version of EICAR are valid applications, they are just for detection.

So, it sounds like it is catching you download the com file in which case it is scanning your files properly. If you do get the com on your computer and then manually scan it you should also find it is detected. If you are looking for the scanning on execution just rename the .com to .exe as it isn't valid either way.

link|improve this answer
see my comment to Tom – PabloG Aug 22 '11 at 19:29
I can't test it right now but you should be able to just rename the .com to a .exe and get the results you are looking for. You should be able to add any extension you want and it should detect. – David Remy Aug 22 '11 at 20:22
feedback
up vote 0 down vote

For the EICAR test using a local file, you generally need to disable your antivirus software, then download the test tool, then reenable the software.

Otherwise, your AV catching it on download or thumb drive insertion means it's working properly.

link|improve this answer
disabling the AV doesn't make any difference, the problem is running a 16-bit program on a 64-bit Win – PabloG Aug 22 '11 at 19:18
feedback
up vote 0 down vote

The purpose of the EICAR file is to identify whether your anti virus is able to detect the file entering your system, which is the exact place where your anti virus should stop the file and not at a later point. If it blocks it there it will prevent execution as well unless you manually configured your anti virus to do something different. So, EICAR works on 64 bit and you are unlikely to need an alternative test file.

Another thing with 64 bit is that a lot of viruses fail to execute because they don't apply to 64 bit code. ;)

link|improve this answer
I used to check the filesystem AV protection with EICAR.COM, because the user can download an infected program from another PC, then I show him/her the AV virus warning when he/she tries to execute the infected program. With an 64-bit OS I cannot do that because the "16-bit incompatibility warning" shows up before the AV pops up the virus warning. – PabloG Aug 22 '11 at 19:28
@PabloG: Your AV is supposed to scan incoming files, rather than files that are executed. If you can't catch the EICAR.COM from entering your computer, then there is a security issue... – Tom Wijsman Aug 22 '11 at 22:59
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.