How can I test several anti-virus programs to determine which performs the best, so that I can writing reviews?
Where can I find viruses for tests?
6
10
If you just want to see if it's working; you can use the EICAR test file, download it here. Or, save the string
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*[1]
to a file which should trigger the virus scanner. You might also want to compress/archive the file to test the compressed/archived file scanning capabilities of your scanner...
More details can be find on their site or Wikipedia:
The EICAR test file (official name: EICAR Standard Anti-Virus Test File) is a file, developed by the European Institute for Computer Antivirus Research, to test the response of computer antivirus (AV) programs. The rationale behind it is to allow people, companies, and AV programmers to test their software without having to use a real computer virus that could cause actual damage should the AV not respond correctly. EICAR likens the use of a live virus to test AV software to setting a fire in a trashcan to test a fire alarm, and promotes the EICAR test file as a safe alternative.
AV programmers set the EICAR string as a verified virus like any other signatures. A compliant virus scanner, when detecting the file, will respond in exactly the same manner as if it found genuinely harmful code. Its use can be more versatile than straightforward detection: a file containing the EICAR test string can be compressed or archived, and then the antivirus software can be run to see whether it can detect the test string in the compressed file.
-
2
-
4"EICAR likens the use of a live virus to test AV software to setting a fire in a trashcan to test a fire alarm, and promotes the EICAR test file as a safe alternative." it's a good point, but pushing the "TEST" button on a fire alarm only tells me the sound works, not that the product actually does what it's sold to do (detect heat/smoke from a fire). seems like a test file is the same kind of thing -- good for telling me my desktop AV solution is working; but not a substitute for an actual rigorous product test. – quack quixote Jan 7 '10 at 17:13
-
2@~quack Good example and I agree, just throwing out the most basic test to make sure the AV is working. If I pressed the TEST button on my smoke alarm, and I didn't work, I wouldn't keep using it. – Chris Bartow Jan 10 '10 at 15:05
3
+50
There are a few virus depositories one can find, but they are not too helpful.
For example, the article Test Your Antivirus – 6000 virus download contains a link to file containing 6000 files, supposedly all viruses, but unfortunately dating from 2009. Given that a good antivirus product may add to its protection database several thousand new virus variants per day (not necessarily the same as several thousand virus signatures), these are hopelessly outdated.
I would also remark that a good antivirus should be good in prevention, detection and eradication. The detection is unreliable, because antivirus products are always running behind the virus writers. The eradication part is always the weakest, and cleaning up after a virus may be incomplete or cause malfunctions, which is why reformatting and re-installation is often counseled after an infection. Even the US army is vulnerable and helpless against an infection.
I don't know of any good prevention tests, which in my opinion are after all the most important function. For detection you could consult sites which specialize in running antivirus products against virus samples (none of them publishes its test suite). Some such sites are :
2
To really test various antivirus solutions you need a PC you can infect, test software A on, wipe clean, reinfect, test software B on, etc.
There are two ways to make this easy -- one cheap, one... not-so-cheap.
Cheap: take an older PC, do a fresh install (with full formatting) of your OS, and take an image of the drive in that state. Then you can infect the PC and test software, and restore from the image when done.
Pros: cheap. easier to lock down so infections don't get out of hand.
Cons: time consuming.Not-so-cheap: Use a virtual machine as the testbed for infections. Same concept: install OS, backup the clean drive, infect PC, test software, restore image, re-infect, test more software.
Pros: easier to restore from clean image. can run multiple tests at once.
Cons: more complicated to manage. requires more expensive hardware, especially when running multiple tests at once. can be harder to lock down, especially if your host OS can be infected by the viruses you're testing with.
answered Jan 7 '10 at 14:48
-
3How is using a virtual machine "not-so-cheap"? Also, instead if storing images of the VM, you can just use snapshots/differencing disks and roll back the changes when your test is complete. – Goyuix Jan 7 '10 at 15:34
-
1you can do VMs very cheap if you know what you're doing and can plan it well, certainly. if you don't know what you're doing it can get really expensive. it's not as "cheap" as the first option, which was the point of calling it "not-so-cheap". – quack quixote Jan 7 '10 at 17:06
-
and re: snapshots. like i said, easier to restore to a clean image state. this post glosses over lots of details and just gives highlights. obviously if you're going to perform this kind of test you'll have some details to fill in. – quack quixote Jan 7 '10 at 17:12
-
VmWare player would probably work well for this and it is free for personal use, same with VirtualBox (though after trying both, I prefer VmWare). WmWare Workstation is more expensive, but well worth it for a developer. – TimothyAWiseman Nov 28 '11 at 22:00
2
Try limewire. Search for something unmentionable and download the executable ones.
OR, install web of trust and go to the sites with red ratings.
OR, sign up for shady mailing lists and open the attachements.
OR, post your email somewhere public with a request for virii.
Yes, virii is the plural of virus.
-
4'viruses' is the correct English plural for the singular 'virus'. Viri, virii, and so on are all slang. – Tamara Wijsman Aug 16 '10 at 9:58
2
I would tend to answer that you can't really do this. The reasoning is that all professional virus manufacturers and those who rate them maintain honeypot nets - a series of (usually) virtualized computers which either passively sit and/or go to known dangerous sites hoping to get infected so the malware infection attempts can be examined and analyzed and the performance of various programs rated. You (probably) don't have the resources to do this with sufficient size to have a statistically reliable sample.
The other thing they do is to employ researchers and companies to actively create variant and sometimes novel malware and then send those against the programs to see how the heuristic defenses fare versus the old style signature files. New and never before seen variants cannot be picked up the signatures so the heuristics are tested this way. Again - you probably won't have the resources to do this.
Old style signature files would be tested against known virus samples to see how the scanning works for speed, but testing against single samples and testing against multiple infections may result in widely different results.
-
Although perhaps something like this is the right approach. Given that you have a way of finding real viruses, just do the whole thing in a VM. – Adrian Ratnapala Dec 2 '11 at 9:31
