GPEN · Question #360
You have received a file named new.com in your email as an attachment. When you execute this file in your laptop, you get the following message: 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!' When you open the
The correct answer is A. Do nothing.. The string and behavior described are the EICAR Standard Anti-Virus Test File, which is a completely harmless, industry-standard test file used to verify antivirus software functionality, not actual malware.
Question
You have received a file named new.com in your email as an attachment. When you execute this file in your laptop, you get the following message:
'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!' When you open the file in Notepad, you get the following string:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* What step will you take as a countermeasure against this attack?
Options
- ADo nothing.
- BTraverse to all of your drives, search new.com files, and delete them.
- CClean up your laptop with antivirus.
- DImmediately shut down your laptop.
How the community answered
(48 responses)- A83% (40)
- B6% (3)
- C2% (1)
- D8% (4)
Why each option
The string and behavior described are the EICAR Standard Anti-Virus Test File, which is a completely harmless, industry-standard test file used to verify antivirus software functionality, not actual malware.
The EICAR test file is not malicious code - it is a standardized, inert 68-byte ASCII string ratified by the European Institute for Computer Antivirus Research specifically so that users and administrators can safely test whether their antivirus software is operational. No data, files, or system state are damaged by executing it, so no remediation action is required.
Searching for and deleting new.com files is unnecessary and potentially harmful to the system because the EICAR file is harmless and no infection has occurred.
Running antivirus cleanup implies an infection exists; the EICAR file is not a virus or malware and will cause no damage, so cleanup is unwarranted.
Immediately shutting down the laptop is an overreaction to a benign test file and would cause unnecessary disruption without addressing any real threat.
Concept tested: EICAR standard antivirus test file identification
Source: https://www.eicar.org/download-anti-malware-testfile/
Topics
Community Discussion
No community discussion yet for this question.