Test Your Antivirus Software

Is your AV software doing its job? A batch file automates an AV checkup.

A Web Exclusive from Windows IT Pro
Dick Lewis
Feature
InstantDoc #47894
Windows IT Pro

Antivirus software has become so simple to install, so efficient, and so dependable that we take it for granted. We install the virus-scanning software of our choice, add the newest scanning engine and signature file, and enable Automatic Updates. It's easy to adopt a "set it and forget it" attitude about this important software.

But how do you know that your virus scanning is really working as advertised? What if an administrator stops the virus-scanning service and neglects to restart it? What if a new virus comes in under the radar screen and disables virus scanning as part of its payload agenda? What if your antivirus software is configured incorrectly or has been removed altogether? Any of these hypothetical scenarios could be serious indeed and expose your corporate environment to the risk of infection.

New developments in the world of storage and the presentation of data add more complexity to antivirus protection. If you use Microsoft Dfs, you might have multiple servers' resources displayed in one hierarchical tree. If virus scanning is degraded on one server node, the tree will contain virus-protected folders mixed in with the unprotected folders that physically reside on the degraded node. Also, if you use a storage device that depends on separate Windows nodes for virus scanning, you could have a protection failure that isn't immediately evident. . . .

The article is well thought out and the batch could be useful if modified to point to testing a real virus. Unfortunately, other than to see if you haven't partially uninstalled your anti-virus solution or corrupted it or seriously misconfigured it, you will be out of luck testing with EICAR. EICAR test files are seriously a joke and in no way gauge how valuable or decent your anti-virus software might be. For an understanding of just how good an AV product is or is not one might try going to www.av-comparatives.org for an honest perspective as to the quality of the AV an individual or company will decide to use. Hopefully they will check an unbiased site such as this before they purchase an overpriced solution with bells and whistles with a weak/slow support system with poor definitions and a weak heuristic scanning engine. All anti-viruses are sadly not created equal. Most people will find out this fact to late when the damage is done. Expecting EICAR test to show the strength or lack of it of an AV would be foolish at best. A ten year old AV with no updates and worst in class could scan EICAR files detect them and pass the "test" so to speak. This is why EICAR test has no real value in my mind. Well no offense intended of course but to ask if if AV is doing it's job by using EICAR well thanks but no thanks.

blahblahblah February 23, 2006 (Article Rating:

)

Good Hunting McAfee VirusScan..Greatest.. :)

next123 May 04, 2008 (Article Rating:

)

You must log on before posting a comment.

If you don't have a username & password, please register now.