How can I test my virus scanner?

Question

How can I test several anti-virus programs to determine which perform the best, so that I can writing reviews? Where can I find viruses for tests?

Answer 1

If you just want to see if it's working; you can use the EICAR test file, download it here. Or, save the string

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*[1]

to a file which should trigger the virus scanner. You might also want to compress/archive the file to test the compressed/archived file scanning capabilities of your scanner...

More details can be find on their site or Wikipedia:

The EICAR test file (official name: EICAR Standard Anti-Virus Test File) is a file, developed by the European Institute for Computer Antivirus Research, to test the response of computer antivirus (AV) programs. The rationale behind it is to allow people, companies, and AV programmers to test their software without having to use a real computer virus that could cause actual damage should the AV not respond correctly. EICAR likens the use of a live virus to test AV software to setting a fire in a trashcan to test a fire alarm, and promotes the EICAR test file as a safe alternative.

AV programmers set the EICAR string as a verified virus like any other signatures. A compliant virus scanner, when detecting the file, will respond in exactly the same manner as if it found genuinely harmful code. Its use can be more versatile than straightforward detection: a file containing the EICAR test string can be compressed or archived, and then the antivirus software can be run to see whether it can detect the test string in the compressed file.

— Wikipedia - EICAR Test file

Answer 2

There are a few virus depositories one can find, but they are not too helpful.

For example, the article Test Your Antivirus – 6000 virus download contains a link to file containing 6000 files, supposedly all viruses, but unfortunately dating from 2009. Given that a good antivirus product may add to its protection database several thousand new virus variants per day (not necessarily the same as several thousand virus signatures), these are hopelessly outdated.

I would also remark that a good antivirus should be good in prevention, detection and eradication. The detection is unreliable, because antivirus products are always running behind the virus writers. The eradication part is always the weakest, and cleaning up after a virus may be incomplete or cause malfunctions, which is why reformatting and re-installation is often counseled after an infection. Even the US army is vulnerable and helpless against an infection.

I don't know of any good prevention tests, which in my opinion are after all the most important function. For detection you could consult sites which specialize in running antivirus products against virus samples (none of them publishes its test suite). Some such sites are :

AV-TEST
AV-Comparatives
TopTenReviews

Answer 3

To really test various antivirus solutions you need a PC you can infect, test software A on, wipe clean, reinfect, test software B on, etc.

There are two ways to make this easy -- one cheap, one... not-so-cheap.

• Cheap: take an older PC, do a fresh install (with full formatting) of your OS, and take an image of the drive in that state. Then you can infect the PC and test software, and restore from the image when done.
  
  Pros: cheap. easier to lock down so infections don't get out of hand.
  
  Cons: time consuming.

• Not-so-cheap: Use a virtual machine as the testbed for infections. Same concept: install OS, backup the clean drive, infect PC, test software, restore image, re-infect, test more software.
  
  Pros: easier to restore from clean image. can run multiple tests at once.
  
  Cons: more complicated to manage. requires more expensive hardware, especially when running multiple tests at once. can be harder to lock down, especially if your host OS can be infected by the viruses you're testing with.

Answer 4

Try limewire. Search for something unmentionable and download the executable ones.

OR, install web of trust and go to the sites with red ratings.

OR, sign up for shady mailing lists and open the attachements.

OR, post your email somewhere public with a request for virii.

Yes, virii is the plural of virus.

Answer 5

I would tend to answer that you can't really do this. The reasoning is that all professional virus manufacturers and those who rate them maintain honeypot nets - a series of (usually) virtualized computers which either passively sit and/or go to known dangerous sites hoping to get infected so the malware infection attempts can be examined and analyzed and the performance of various programs rated. You (probably) don't have the resources to do this with sufficient size to have a statistically reliable sample.

The other thing they do is to employ researchers and companies to actively create variant and sometimes novel malware and then send those against the programs to see how the heuristic defenses fare versus the old style signature files. New and never before seen variants cannot be picked up the signatures so the heuristics are tested this way. Again - you probably won't have the resources to do this.

Old style signature files would be tested against known virus samples to see how the scanning works for speed, but testing against single samples and testing against multiple infections may result in widely different results.