Is Your Antivirus Working Properly? Here’s How to Test It

You’ve just installed a new antivirus, and its icon is now sitting silently in the taskbar’s system tray. You’re probably wondering whether it’s actively monitoring for suspicious activities or just doing nothing while consuming system resources. Well, there are a number of ways to find out if your antivirus is working as intended.

Use the EICAR Anti-Malware Test File

Let’s start with something simple. Open Notepad (or any text editor), copy and paste the text below to the text editor, and save the file using any name you like.

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Alternately, you can download the file from EICAR, an organization that’s focused on IT security research. You should receive a detection alert from your antivirus not long after you save or download the file. If not, try scanning the file manually.

This industry-standard test file is provided by EICAR in collaboration with security vendors. AV products treat the file as if it were an antivirus, but it is actually harmless. When it’s run as a COM executable format, it merely displays a text output that says “EICAR-STANDARD-ANTIVIRUS-TEST-FILE!” Failure to detect the test file means either your antivirus does not support the test file or is experiencing problems.

Use Comodo’s Security Testing Software

A text file for testing is nice and all, but it doesn’t actually mimic malware behavior. Give your antivirus a bit more challenge by using the HIPS and Firewall Leak Test Suite by computer and Internet security company Comodo. It’s a software utility that offers five tests for simulating malware propagation tactics without actually releasing the payload (the harmful portion of malware). The utility is primarily designed to test-drive firewall programs, but it can also be used for antivirus software. Modern AV products come with heuristic scanners that monitor program behaviors for suspicious activities. Should your antivirus fail to catch the utility as it runs its tests, Comodo suggests reconfiguring your antivirus settings for heightened security.

Why Not Use a Real Virus?

The out-of-the-box thinker in you might be asking: why not infect your computer with a real virus? You have a top-notch antivirus product installed on your computer, and you believe that it can catch every malware sample you throw at it. Such reasoning poses unnecessary, high risk to your computer and yourself. Testing your computer with real malware is like wearing a bulletproof vest and shooting yourself to test the efficacy of the body armor.

No one in their right minds should do it, just as no one should infect their computers purposefully with malware to check if their antivirus is working. No antivirus is perfect; independent antivirus testing labs have shown that no antivirus ever remains flawless at protecting computers. Virus infections can get through protected computers from time to time, especially when you factor in human vulnerability.

But if you insist, security expert Lenny Zeltser provides a list of sources from where you can get malware samples. We firmly recommend that you use these samples on a test computer or virtual machine. Make sure it contains no important files and information that cyber criminals can exploit for fraud, identity theft and other cyber crimes. Malicious software is not something you experiment with haphazardly.