ESET LiveGuard Advanced – Table of Contents

Test ESET LiveGuard Advanced functionality

Copy current article URL Share via email

This article (PDF) Whole documentation (PDF)

To test ESET LiveGuard Advanced functionality with ESET applications, follow the steps below:

ESET PROTECT users

ESET Cloud Office Security users

FAQ

Is this actual malware?

No, this EdtdTestFile.exe is just a dropper of Eicar (a standard malware test file). This event is detected during analysis in a sandbox in ESET LiveGuard Advanced.

How can I be sure?

Here are the source codes of the test files:

•Windows executable

#include <fstream>
#include "tchar.h"
#include "windows.h"

int main(int argc, char **argv)
{
  if (argc == 1)
  {
     std::ofstream dropped;
     dropped.open(_T("eicar.com"));
     dropped << "X50!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*";
     dropped.close();
  }
  ::MessageBox(nullptr, _T("EDTD test file has been executed.\n2023.10.23 12:34"), _T("EDTD test file"), MB_OK);
  return 0;
}

•Linux binary

#include <fstream>
#include <iostream>
#include <stdio.h>

int main(int argc, char **argv)
{
  if (argc == 1)
  {
     std::ofstream dropped;
     dropped.open("eicar.com");
     dropped << "X50!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*";
     dropped.close();
  }
  std::cout << "EDTD test file has been executed." << std::endl;
  getchar();
  return 0;
}

What if Deep Behavioral Inspection detects the file instead of ESET LiveGuard Advanced?

Deep Behavioral Inspection monitors executed files and can detect the creation of the Eicar file (a standard malware test file). To avoid detection, execute the file with any parameter, for example:

EdtdTestFile.exe x

˄˅

Test ESET LiveGuard Advanced functionality

ESET PROTECT users

I. Prerequisites

II. Prepare the test file

III. Test ESET LiveGuard Advanced

IV. Test multiple files

V. Test proactive protection