Package de.xima.fc.e2e.containerplugin.logic

Class EicarVirusTestFileScanner

  • All Implemented Interfaces:
    IMalwareScanner
    public final class EicarVirusTestFileScanner
extends Object
implements IMalwareScanner
    Malware scanner that detects the EICAR virus test file (but not in ZIP archives etc.) According to the spec:

    It is also short and simple – in fact, it consists entirely of printable ASCII characters, so that it can easily be created with a regular text editor. Any anti-virus product that supports the EICAR test file should detect it in any file providing that the file starts with the following 68 characters, and is exactly 68 bytes long:

    X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

    The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. The only whitespace characters allowed are the space character, tab, LF, CR, CTRL-Z. To keep things simple the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the test file is that the third character is the capital letter „O“, not the digit zero.
    Author:
    unspecified

    • Constructor Detail

      • EicarVirusTestFileScanner

        public EicarVirusTestFileScanner()

    • Method Detail

      • scan

        public IMalwareScanResult scan​(Path file)
                        throws Exception
        Description copied from interface: IMalwareScanner
        Scans an existing file on the file system for malware. Implementations should scan the file, but leave the file untouched. If it cannot be avoided, it is permissible for implementations to delete the file when malware was detected, but discouraged. It is up to the caller of this method to decide what should be done with the file.
        Specified by:
        scan in interface IMalwareScanner
        Parameters:
        file - A file on the file system to scan for malware. This path must be an absolute path.
        Returns:
        The result of the scan.
        Throws:
        Exception - When the scan could not be performed. Be careful however, when an exception is thrown, the file is assumed to contain malware!