Talk:EICAR test file

message: I am wondering whether it is actually ok to include the file itself here? isn't it copyrighted by eicar or whoever created it? or is too short to be copyrightable at all? i would be very happy if anyone could shed some light on this...User:RobertLemmen  —Preceding unsigned comment added by 93.97.72.81 (talk) 20:03, 19 March 2010 (UTC)
replies: text: "You are encouraged to make use of the EICAR test file" according to EICAR's page about the test file. Or are you referring to WMF policy that is intentionally stricter than copyright, like the concept of a "not free enough" license on Commons? --Damian Yerrick (talk | stalk) 14:13, 31 October 2011 (UTC)
thread_title: Potential Copyright Problem?

message: Please give the date (preferably in a signature) and nature of the scan (i.e. plaintext, encrypted, hdd, email, ...).  Be sure to fully update your software so that your signed date is accurate.
:Doesn't this violate Wikipedia's policy on No Original Research? --DragonHawk 20:39, 1 July 2006 (UTC)
replies: text: Yes, but not badly, and at least the results are verifiable. Btw, "McAfee Total Protection for Small Businesses" obliterated the thing without giving me a chance to tell it not to. Stevage 13:48, 9 August 2006 (UTC)
thread_title: Confirmed successes and failures

message: *NOD32 string saved as a plaintext or .com file. -- malo (tlk) (cntrbtns) 03:53, 28 June 2006 (UTC)
thread_title: Successes

message: * Grisoft AVG Anti-Virus doesn't appear to recognize the string, even in plaintext. 74.132.209.231 03:02, 28 June 2006 (UTC)
thread_title: Failures

message: The one thing this article doesn't tell me is *why* AV programs pick it up. Are they specially taught to recognise this string, or is there something inherently "virus-like" in the file? When you think about it, since the file *is* benign, there's no particular reason they should do anything about it. It's like calling the fire brigade to tell them you're about to set off the fire alarm, then complaining when they don't show up. Stevage 13:48, 9 August 2006 (UTC)
replies: text: It's more like holding fire drills, or testing your smoke alarm -- without starting a fire. Detecting the file means that your virus scanner is probably working properly. Furthermore, there's the possibility of testing your virus scanner's capability to detect viruses in compressed files, for example, without having to get an actual virus and then get your virus scanner to check it. You may want to use the Wikipedia:Reference desk for questions like this in future. Dysprosia 07:21, 10 August 2006 (UTC)
replies: text: Reference desk? No, the article should explain more about how it works. heqs 14:33, 23 October 2006 (UTC)
replies: text: The above guy has a point. If he still had to ask questions about basic information then this article needs expanding. The Kinslayer 12:26, 10 January 2007 (UTC)

text: The above point is still true today; it's not at all clear why this would be picked up as a virus by any scanning software.  Tempshill (talk) 22:51, 6 April 2009 (UTC)
replies: text: No, there is nothing *inherently* 'virus-like' about these files - nor is there about real viruses; this is why virus scanners must constantly update to keep up with new viruses.  Virus scanners work, essentially, by matching patterns of bytes found in files on the user's machine with patterns of bytes found in their database of *known* viruses.  When new viruses are found, new patterns are added to the database and this is pushed out as an automatic update to the virus scanning software.  This file is detected as a virus (even though it isn't) because the virus software vendors have added its pattern to their database.62.232.250.50 (talk) 11:35, 9 November 2011 (UTC)
thread_title: Why do they detect it?

message: :It makes use of self-modifying code to work around technical issues that this constraint makes on the execution of the test string.
What does this sentance mean?  Regards, Ben Aveling 05:17, 28 November 2006 (UTC)
replies: text: See: Self Modifying Code62.232.250.50 (talk) 12:11, 9 November 2011 (UTC)
replies: text:  If it is not clear enough I could try to explain it better... Rjgodoy (talk) 09:54, 25 March 2008 (UTC)
thread_title:  It makes use of self-modifying code 

message: The Adoption section says that one Antivirus/Antimalware/EDR product doesn't detect it - Malwarebytes.
However, it does seem to both detect and block the file, even if it doesn't show on VirusTotal
2603:6011:9403:B900:C917:690F:57A0:8737 (talk) 12:02, 10 May 2022 (UTC)
thread_title:  Update to the Adoption section 

message: EICAR ever make one for newer OSes?  If so, can someone from EICAR add it to the article?  Interestingly, there's a malware called "Emptyspace" that is a text file that looks blank but is in fact executable.  Not sure if that should be mentioned as it uses a similar technique.  74.196.181.80 (talk) 16:57, 12 February 2024 (UTC)
thread_title:  An updated version for non-16-bit-compatible NTVDM?  Similar examples?