Member Avatar for ScoobyDoo2

Hi,
I have just recently "regained" my Broadband connection after ~6weeks of ISP "upgrades" anyway ... to the point ;) I am now getting "Bombarded" by Eicar test string viruses? NIS 2005 picks them up and quarantines them but when I am getting 3-400 at a time sometimes several times a day My machine is working O/T at times. Is there a way to find where they originate? I'm presuming malicous origin .. probing/testing keeping my Security busy? Has anyone had similar experience? I have run NIS online virus checker and Spybot but nothing seen? Any help / recomendations gratefully received :o Thanx Scooby

  • 2 Contributors
  • 1 Reply
  • 120 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by DMR

Dani AI

Generated

reported large numbers of EICAR detections and correctly identified them as test-signature hits. The investigative goal is to find what is creating or delivering those test files so the flood can be stopped. The checklist below is a practical, low-risk workflow to locate the source and confirm whether the events are local, from another LAN host, or coming from the Internet.

First, preserve evidence and reduce noise. Export or save the AV quarantine/history entries (timestamps, original path or context, and any process name reported). Take the machine offline while collecting data to avoid repeated deliveries. Do not restore quarantined items on a production system; use a disposable VM for any deeper inspection.

Use process- and file-level tracing next. Run Autoruns and Process Explorer to spot persistent processes and services. Run Process Monitor (Procmon) with filters for CreateFile/WriteFile events and a path filter that catches likely temp/download locations—this will show which process is creating files at the time of the detections. For live network troubleshooting, use netstat -ano (or TCPView) to map active connections to PIDs, then match PIDs to executables (tasklist /fi "PID eq <pid>") or view them in Process Explorer. Search disk and browser/temp mail directories for recently created files or filenames that include "eicar".

If multiple machines see the same hits, look at the mail server/router/ISP or any gateway AV appliance that might be scanning or re-injecting test files. Capture traffic at detection time with a packet capture (Wireshark) to identify the delivering host and protocol. Relevant tools: Autoruns, Process Monitor, Process Explorer, TCPView (Sysinternals) and Wireshark. Links: Autoruns, Process Monitor, TCPView, Process Explorer, Wireshark, netstat docs.

If the source remains unclear after those steps, collect the AV logs, process traces and packet captures and escalate to the ISP or a security admin for deeper forensics.

Member Avatar for DMR

Eicar files aren't malicious; they're virus testing tools. Think of them as "virus simulators". Here's more info from Symantec (Norton):

The Eicar Test String is not a real virus. It is a text file that is used to test antivirus software. By default, the file name is Eicar.com, but it could be renamed to anything. Eicar.com can be downloaded from the Eicar Web site at . It can also be created in any text editor. It is not a virus, and it cannot infect your computer. It contains the EICAR Test String.

Norton AntiVirus detects this as EICAR Test String.

If it was detected on your computer, it likely was downloaded or created by someone for testing purposes.

This test string cannot be repaired. To remove it, delete all files that are detected as EICAR Test String.

[img][/img]

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.