The purpose of this chart is to compare the range and efficacy of the various
mechanisms utilised by various different anti-virus solutions (with
particular interest in how well phpMussel holds up against those various
different anti-virus solutions in regards to those mechanisms), by way of
scanning various permutations of EICAR (the industry standard sample
generally used to confirm the functionality and efficacy of anti-virus
signatures, signature databases, and the engines that utilise them).
In the context of this chart, "permutations" refers to permutations of the
original sample's container (e.g., whether uncontained, contained in
a ZIP file, in a GZ file, as an embedded file within a PDF document, etc),
but doesn't refer to permutations of the actual original sample itself.
The reason why the chart considers various permutations of EICAR, to the
exclusion of any other samples or any other kinds of permutations, is that my
interest in writing this chart is not towards signatures or
signature databases, but rather, the ability of the anti-virus solutions in
question to handle and process files in such a way as to be able to deal with
these permutations with their existing signatures, without the need to write
additional signatures for each and every permutation.
This is helpful to indicate whether further work needs to be done for an
engine to be able to read and understand specific container formats, whether
existing mechanisms are sufficient, or whether scanning a file blindly
without regard to its format may be acceptable in some instances.
To keep things simple, I'll indicate only whether the scan results in a
(✔️)hit (meaning, detected), a
(❌)miss (meaning, not detected), or
(❓)other (meaning, something went wrong when scanning, the
results are generally unavailable at the time, or the results are unknown),
without regard to the specific identifiers, virus names, or other information
produced as a result the scan.
The beginning of the chart will show phpMussel, since it's my primary
interest, followed by ClamAV, since phpMussel's signatures are based upon
ClamAV's signatures. All remaining engines will be listed alphabetically.
| Sample | phpMussel | ClamAV | ALYac | AVG | Ad Aware | AegisLab | AhnLab V3 | Alibaba | Antiy AVL | Arcabit | Avast | Avast Mobile | Avira | Baidu | BitDefender | BitDefenderTheta | Bkav | CAT QuickHeal | CMC | Comodo | Cynet | Cyren | DrWeb | ESET NOD32 | Elastic | Emsisoft | Endgame | F Prot | F Secure | FireEye | Fortinet | GData | Gridinsoft | Ikarus | Jiangmin | K7AntiVirus | K7GW | Kaspersky | Kingsoft | Lastline | MAX | Malwarebytes | MaxSecure | McAfee | McAfee GW Edition | Microsoft | NANO Antivirus | Panda | Qihoo 360 | Rising | SUPERAntiSpyware | Sangfor Engine Zero | SecureAge APEX | SentinelOne | Sophos AV | Sophos ML | Symantec | Symantec Mobile Insight | TACHYON | Tencent | TotalDefense | Trapmine | TrendMicro | TrendMicro HouseCall | Trustlook | VBA32 | VIPRE | ViRobot | Webroot | Yandex | Zillya | ZoneAlarm | Zoner | eScan |
| eicar.txt Original sample; No container. Scan date: 2020.11.22 |
✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ❌ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| eicar.pdf Embedded in PDF 1.1 document. Scan date: 2020.11.22 |
✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ❌ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ❌ | ✔️ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ❓ | ❌ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ❌ | ✔️ | ❓ | ✔️ | ❌ | ✔️ | ❌ | ✔️ |
| eicar.ppt Embedded in PPT (PowerPoint Presentation) document. Scan date: 2020.11.22 |
❌ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ✔️ | ✔️ | ❓ | ❌ | ❌ | ✔️ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ✔️ | ❌ | ❌ | ❓ | ✔️ | ❓ | ❓ | ❌ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ❌ | ❌ | ❌ | ❌ | ❓ | ❌ | ❌ | ❌ | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ✔️ | ❌ | ❌ | ✔️ | ❓ | ❌ | ❌ | ❌ | ❌ | ❓ | ❌ | ❌ | ❌ | ❓ | ✔️ | ✔️ | ❓ | ❌ | ❌ | ❌ | ❓ | ❌ | ❌ | ❌ | ❌ | ✔️ |
| eicar.txt.gz GZip archive using deflate. Scan date: 2020.11.23 |
✔️ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ |
| eicar.txt.bz2 Bzip2 archive. Scan date: 2020.11.23 |
✔️ | ❓ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ❌ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ❌ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ❌ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ |
| eicar.txt.tar Tar archive. Scan date: 2020.11.23 |
✔️ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ❌ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ❌ | ❌ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| eicar.txt.deflate.zip Zip archive using deflate. Scan date: 2020.11.23 |
✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| eicar.txt.lzma.zip Zip archive using LZMA. Scan date: 2020.11.23 |
✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
| eicar.txt.wim Wim archive. Scan date: 2020.11.23 |
❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❓ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ❌ | ✔️ | ❌ | ❌ | ❌ | ❓ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ❌ | ❌ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ❌ | ❌ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ❓ | ❓ | ❌ | ❌ | ❌ | ❓ | ❌ | ❌ | ❌ | ❓ | ❌ | ❌ | ❓ | ❌ | ❌ | ❌ | ❓ | ❌ | ❌ | ❌ | ❌ | ✔️ |
| eicar.txt.lzma2.7z 7z archive using LZMA2. Scan date: 2020.11.23 |
❌ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ✔️ |
| eicar.txt.lzma2.xz XZ archive using LZMA2. Scan date: 2020.11.23 |
❌ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ❌ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ✔️ | ❌ | ❌ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ✔️ | ✔️ | ❓ | ❓ | ❌ | ❌ | ✔️ | ❓ | ❌ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ❌ | ❌ | ❓ | ❌ | ❌ | ✔️ | ✔️ | ✔️ |
| eicar.phar Phar archive (PHP archive). Scan date: 2020.11.23 |
❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ |
| eicar.rtf Embedded in RTF (Rich-Text Format) document. Scan date: 2020.11.23 |
❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❓ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ❌ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ❓ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❌ | ❌ | ❌ | ✔️ | ❌ | ❓ | ✔️ | ❌ | ❌ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | ✔️ | ❓ | ❓ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ❌ | ❌ | ❓ | ✔️ | ✔️ | ❓ | ✔️ | ✔️ | ❌ | ❓ | ❌ | ❌ | ✔️ | ✔️ | ✔️ |