Testing that virus detection works

SAVTEST.EXE and SAVTST32.EXE are utilities designed to test the operation of Sophos Anti-Virus by using the so-called EICAR test string which Sophos Anti-Virus recognises as a virus. Both can be found in the /TOOLS folder of the Sophos supplementary CD.

The EICAR test string is not a virus; it is a completely harmless short program designed to trigger the anti-virus software into recognising it as a virus. Sophos Anti-Virus will report its presence as the 'EICAR-AV-Test' virus.

What to do

• SAVTEST.EXE runs under Windows 95/98/Me, Windows NT/2000/XP/2003, DOS/Windows 3.1x, NetWare and OS/2.
• SAVTST32.EXE is a Windows version of this program which runs under Windows 95/98/Me and Windows NT/2000/XP/2003 only.

The EICAR test string is also detected by default by Sophos Anti-Virus for UNIX and OpenVMS, and can be detected by Sophos Anti-Virus for Macintosh when the 'Include non-Macintosh virus detection' option is selected.

Under OpenVMS, a detectable EICAR.COM cannot be created using a VMS text editor (VMS has its own format for text files). It must be copied in binary mode from a non-VMS system.

For more information, see the SAVTEST and SAVTST32 release notes.