The EICAR test file was used to functionally test an antivirus system. As it stands today almost every AV system will flag EICAR as being a "test" virus. For more information on this historic test virus please click here.
Currently the EICAR test file is only good for testing the presence of an AV solution, but it doesn't check for engine file or DAT file up-to-dateness. In other words, why do a functional test of a system that could have DAT files that are more than 10 years old. With the quantity of viruses released daily, over time, the EICAR signature loses value as a testing tool.
That being said, I think EICAR needs to be updated/modified to be effective test that works in conjunction with an AV management solution.
Some people on serverfault responded to an earlier revision of this question.
To answerers: Please focus on the point:
This revised question is about testing the functionality of an AV system.
Please don't respond with management solutions since they don't test what's deployed and in the field. Management solutions report and that may be flawed in one way or another for example: sometimes a machine may not be included in routine AV administration by operator error. Sometimes AV is managed by a different company or group. No matter what your stance is on 'management', this does not count at a post-deployment "test" IMHO. This question is about real world testing, without using live viruses... which is the intent of the original EICAR.
I'm proposing a new EICAR file format with the appendage of an XML blob that will conditionally cause the Antivirus engine to respond.
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-EXTENDED-ANTIVIRUS-TEST-FILE!$H+H* <?xml version="1.0"?> <engine-valid-from>2010-1-1Z</engine-valid-from> <signature-valid-from>2010-1-1Z</signature-valid-from> <authkey>MyTestKeyHere</authkey>
In this sample, the antivirus engine would only alert on the EICAR file if both the signature or engine file is equal to or newer than the valid-from date. Also there is a passcode that will protect the usage of EICAR to the system administrator.
If you have a backgound in "Test Driven Design" TDD for software you may get that all I'm doing is applying the principals of TDD to my infrastructure.
Based on your experience and contacts how can I make this idea happen?