How good are anti-virus heuristic scanners?

archive.cert.uni-stuttgart.de

20 pointsthristian4 comments

> ESATF is used to "check", so, in order to get a "full" checking, I think it should be treated like a true virus

No, it shouldn't. EICAR is a special test-case, and if it was detected heuristically then Hello, World! would also get flagged as a virus. Not helpful.

A better way to test heuristics in AV scanners would be to run a 6 month out of date antivirus program against viruses that have emerged in the last 6 months, and that is exactly what the heroes at AV Comparatives [1] do every year.

[1] http://av-comparatives.org/

Direct link: http://www.av-comparatives.org/en/comparativesreviews/retros...

Agreed, this is bull. The program prints a single string - hardly threatening. It's not malicious in any way. There's no reason for a heuristic scanner to pick it up.

The EICAR file itself is pretty interesting though: a pure-ASCII executable! http://mirror.href.com/thestarman/asm/eicar/eicarcom.html

8 year old post. Interesting, though.

Reply on news.ycombinator.com