nerdexam
GIAC

GPEN · Question #360

You have received a file named new.com in your email as an attachment. When you execute this file in your laptop, you get the following message: 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!' When you open the

The correct answer is A. Do nothing.. The string and behavior described are the EICAR Standard Anti-Virus Test File, which is a completely harmless, industry-standard test file used to verify antivirus software functionality, not actual malware.

Reporting & Remediation

Question

You have received a file named new.com in your email as an attachment. When you execute this file in your laptop, you get the following message:

'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!' When you open the file in Notepad, you get the following string:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* What step will you take as a countermeasure against this attack?

Options

  • ADo nothing.
  • BTraverse to all of your drives, search new.com files, and delete them.
  • CClean up your laptop with antivirus.
  • DImmediately shut down your laptop.

How the community answered

(48 responses)
  • A
    83% (40)
  • B
    6% (3)
  • C
    2% (1)
  • D
    8% (4)

Why each option

The string and behavior described are the EICAR Standard Anti-Virus Test File, which is a completely harmless, industry-standard test file used to verify antivirus software functionality, not actual malware.

ADo nothing.Correct

The EICAR test file is not malicious code - it is a standardized, inert 68-byte ASCII string ratified by the European Institute for Computer Antivirus Research specifically so that users and administrators can safely test whether their antivirus software is operational. No data, files, or system state are damaged by executing it, so no remediation action is required.

BTraverse to all of your drives, search new.com files, and delete them.

Searching for and deleting new.com files is unnecessary and potentially harmful to the system because the EICAR file is harmless and no infection has occurred.

CClean up your laptop with antivirus.

Running antivirus cleanup implies an infection exists; the EICAR file is not a virus or malware and will cause no damage, so cleanup is unwarranted.

DImmediately shut down your laptop.

Immediately shutting down the laptop is an overreaction to a benign test file and would cause unnecessary disruption without addressing any real threat.

Concept tested: EICAR standard antivirus test file identification

Source: https://www.eicar.org/download-anti-malware-testfile/

Topics

#EICAR test file#antivirus testing#malware identification#incident response

Community Discussion

No community discussion yet for this question.

Full GPEN Practice