Comments on: EICARgen http://blog.didierstevens.com (blog 'DidierStevens) Wed, 08 Feb 2012 19:23:01 +0000 hourly 1 http://wordpress.com/ By: Didier Stevens http://blog.didierstevens.com/programs/eicargen/#comment-45710 Wed, 31 Aug 2011 19:21:29 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-45710 @Anonymous Fixed it!

]]> By: Anonymous http://blog.didierstevens.com/programs/eicargen/#comment-45545 Fri, 26 Aug 2011 09:32:27 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-45545 Is it correct that the archive does not contain an executable anymore?

]]> By: steve54 http://blog.didierstevens.com/programs/eicargen/#comment-42771 Fri, 13 May 2011 00:58:47 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-42771 This isn’t quite as elegant as yours, but it isn’t (yet. at least) detected as a virus. It’s AutoHotKey, so it can be compiled to an exe that’ll run on any Windows version.

Just one line:

FileAppend, X5O!P`%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-
ANTIVIRUS-TEST-FILE!$H+H*, eicar.com

Isn’t AHK nice? :)

]]> By: Romeo29 http://blog.didierstevens.com/programs/eicargen/#comment-40441 Wed, 03 Nov 2010 14:27:31 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-40441 I created a similar program in C, but AVG always caught it. First I thought that AVG is detecting the EICAR code string inside the EXE. So I used simple ROT13 and later XOR encryption to hide the string. But AVG always detects it! Actually AVG checks behavior of the program and finds out that it is dropping EICAR test virus and flags it as Eicar.dropper. No use!

Maybe if you can make some regular Windows program put the code in the target EICAR virus file in steps, then you can survive. BTW, EICARGen is caught both by AVG and avast!.

]]> By: Jack http://blog.didierstevens.com/programs/eicargen/#comment-38580 Wed, 19 May 2010 15:04:31 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-38580 dang, Rising AV didn’t say a thing……..
hmmmmm has always been exceptional at finding stuff

]]> By: Quickpost: New EICARgen Version « Didier Stevens http://blog.didierstevens.com/programs/eicargen/#comment-36727 Fri, 04 Dec 2009 14:59:25 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-36727 [...] Filed under: My Software, Quickpost — Didier Stevens @ 14:58 I never expected to release a new version of EICARgen, but I’m forced to: EICARgen.exe generates just too many false [...]

]]> By: Didier Stevens http://blog.didierstevens.com/programs/eicargen/#comment-35974 Thu, 22 Oct 2009 15:39:16 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-35974 Interesting, thanks for the heads-up.

]]> By: Jan http://blog.didierstevens.com/programs/eicargen/#comment-35973 Thu, 22 Oct 2009 13:25:11 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-35973 Microsoft Security Essentials found the “Trojan:Win32/Meredrop” in EICARgen.exe when extacting the zip-file.
Even before I could test the EICAR Anti-Virus test file, at least MSE is doing it’s job.

]]> By: D0R http://blog.didierstevens.com/programs/eicargen/#comment-33671 Thu, 06 Nov 2008 13:58:24 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-33671 Probably AVAST recognized your program as a virus generator and classified it as malware.
Now wait until Google ranks this very URL with the alert “This site may damage your computer”. :)

]]> By: Didier Stevens http://blog.didierstevens.com/programs/eicargen/#comment-33514 Thu, 25 Sep 2008 13:11:28 +0000 http://didierstevens.wordpress.com/programs/eicargen/#comment-33514 Great!

]]>