From TNPC issue #4.01...

Safely Testing Your AntiVirus Package with the EICAR Test File: Part 2

by Lee Hudspeth
January 11, 2001

Part 1 of this article appeared in TNPC #3.24:
http://www.TheNakedPC.com/t/401/tr.cgi?lee1

In Part 1 I discussed how to test your anti-virus program with a simple, free test file called the EICAR test file. Thanks to everyone who wrote in with the results of these tests on their systems, I have some fascinating feedback. I've analyzed that feedback and will share it with you now. (Note: this is not a statistically rigorous analysis or data set, just the results of an informal poll.)

All told, readers reported on ten different tools. There was a wide dispersion of pass/fail results, primarily because readers are using so many different versions of the same tool; for example, McAfee 4.0, 4.1, 4.5, 5.0, 5.13, and so on. Often it is the older engine versions that fail one or more of the EICAR tests. Since most tools' developers would have been aware of the EICAR standard from the outset, the currency of your virus definition files shouldn't affect the outcome of the EICAR tests. However, an older version of the software engine--not the definition virus files--might not be sophisticated enough to detect a double-zipped threat. (So it was in James W.'s case of McAfee engine 4.1.00 with definitions 4.0.4106; it failed the multilevel compressed file test. I'm not picking on McAfee, this is just an example; it was not the only tool to experience a failure of some kind.)

With only one exception, every TNPCer in this survey who uses the free Personal Edition of InoculateIT likes--no, loves--it. The reader who took exception said, "[Two fails was] a little disappointing, but then again, it's free and I don't really use it." No one else reported any InoculateIT failures, but this reader's last comment caught my eye, "I don't really use it." I hope this reader does use another anti-virus program. We should all consider this reminder:

To safely operate a PC today you must use an anti-virus tool and it should be properly configured, with email and background activity scanning turned on, set to regularly and automatically fetch updates.

Here are the ten tools listed in order by their usage frequency (by those TNPC readers who performed the tests).

* [44%] InoculateIT Personal Edition -- free engine & signature updates:
http://www.TheNakedPC.com/t/401/tr.cgi?lee2

* [21%] McAfee VirusScan:
http://www.TheNakedPC.com/t/401/tr.cgi?lee3

* [15%] Norton AntiVirus:
http://www.TheNakedPC.com/t/401/tr.cgi?lee4

* [ 4%] AVG AntiVirus -- free engine & signature updates:
http://www.TheNakedPC.com/t/401/tr.cgi?lee5

* [ 4%] Kaspersky AVP:
http://www.TheNakedPC.com/t/401/tr.cgi?lee6

* [ 4%] Trend Micro PC-Cillin:
http://www.TheNakedPC.com/t/401/tr.cgi?lee7

* [ 2%] Dr. Solomon:
http://www.TheNakedPC.com/t/401/tr.cgi?lee8

* [ 2%] Panda AntiVirus:
http://www.TheNakedPC.com/t/401/tr.cgi?lee9

* [ 2%] Trend Micro HouseCall -- free on-line virus scanner:
http://www.TheNakedPC.com/t/401/tr.cgi?lee10

* [ 2%] Vet Anti-Virus:
http://www.TheNakedPC.com/t/401/tr.cgi?lee11

You can contact Lee Hudspeth at:
mailto:leehudspeth@TheNakedPC.com

Return to Top

TNPC Hot Tips:

• Email out of control? Spam filling your inbox? People trying to steal your identity? Same here - until I applied these tips. You can too in a new multimedia e-book. Tame Your Email.

• DO YOU MAKE THESE MONEY MISTAKES? Do you know that trying to pay off your high interest rate debts first and/or paying extra on more than one debt is the SLOWEST way to get out of debt? Don't make these same mistakes. Learn more at by clicking here...