User Guide

12-17
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
Chapter 12 Anti-Virus
Sending an Email to the Appliance to Test Anti-Virus Scanning
Step 2 Open a standard text editor, then type the following character string as one line, with no spaces or line
breaks:
Note The line shown above should appear as one line in your text editor window, so be sure to
maximize your text editor window and delete any line breaks. Also, be sure to type the letter O,
not the number 0, in the “X5O...” that begins the test message.
If you are reading this manual on your computer, you can copy the line directly from the PDF file or
HTML file and paste it into your text editor. If you copy the line, be sure to delete any extra carriage
returns or spaces.
Step 3 Save the file with the name EICAR.COM.
The file size will be 68 or 70 bytes.
Note This file is not a virus — it cannot spread or infect other files, or otherwise harm your computer.
However, you should delete the file when you have finished testing your scanner to avoid
alarming other users.
Step 4 Attach the file EICAR.COM to an email message, and send it to the listener that will match the mail policy
you configured in step 1.
Ensure the that the recipient you specify in the test message will be accepted on the listener. (For more
information, see Adding Domains and Users For Which to Accept Messages, page 8-3.)
Note that it may be difficult to email the file if you have virus scanning software is installed for outgoing
mail on a gateway other than the Cisco (for example, a Microsoft Exchange server).
Note The test file always scans as unrepairable.
Step 5 Evaluate the actions you configured for virus scanning on the listener and ensure they are enabled and
working as expected.
This is most easily accomplished by performing one of the following actions:
• Configure the virus scanning settings to Scan and Repair mode or Scan only mode without dropping
attachments.
Send an email with the Eicar test file as an attachment.
Confirm that the actions taken match your configuration for Virus Infected Message Handling (the
settings in Virus Infected Message Handling, page 12-9).
• Configure the virus scanning settings to Scan and Repair mode or Scan only mode with dropping
attachments.
Send an email with the Eicar test file as an attachment.
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*