KAPERSKY ANTI-VIRUS 5.0 - FOR WINDOWS WORKSTATIONS Administrator's Manual page 173

Testing operation of Kaspersky Anti-Virus
You can test the correctness of Kaspersky Anti-Virus operation using
the modified EICAR "virus" only if your anti-virus database was last
updated on or after October 24, 2003, or has the cumulative updates for
October, 2003.
Prefix
No prefix,
standard test
"virus"
CORR–
SUSP–
WARN–
ERRO–
CURE–
DELE–
The first table column lists prefixes to be added at the beginning of the string of
the standard
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-
FILE!$H+H*).
After adding a prefix to the test "virus" save it, for example, to a file under the
name eicar_dele.com; assign names to all the modified "viruses" in the same
manner.
The second column of this table contains the types of objects identified by an
anti-virus application after you have added a prefix. The actions for each type of
objects are defined by Kaspersky Anti-Virus application settings customized by
the administrator.
Infected – An error occurs during an attempt to cure an
object; the object gets deleted.
Corrupted
Suspicious (unknown viral code)
Warning (modified code of a known virus)
Error when scanning the object
Infected – The object is disinfected; the text of the "virus"
body is changed for CURE
Infected – The object is automatically deleted
test "virus"
Table 3. Test "virus" modifications
Object type
(for example, DELE–
173