Eicar Test File

[dundee]

Hello

I would like to know how to test for the Eicar test file. It works with "On Access" but not with "On Demand"

I am doing a "Scan on Demand" and the Eicar file is not being found.

I am running Version MOVE Multiplatform 3.6.1

Any idea?

regards

[rajinp]

Are you running target ODS ?

Make sure ODS started and completed.

[dundee]

Hi rajinp

Thank you for your answer.

I guess the problem is, that I dont see that the ODS has finished. I am looking in the Event log of the scanserver.

I can see a lot of Messages

"On-Demand Scan Started on xxx" with eventid 10 but not so man eventid messages

"On-Demand Scan Completed  un xxx".

Sometimes i can also see that a ODS ist startet twice on the same Server.

I have a policy "Maximum concurrent scans per Offload Scan Server:" 2.

Doesn't that mean that only 2 Servers are beeing scanned at the same time?

I can see that 7 or more Servers are beeing scanned at the same time.

[rajinp]

OK. Just see from the logs whether the ODS is still going on?

that way we will be able to verify the same. If the ODS is going on, then another will not get started.

[dundee]

which log ist that?

[rajinp]

product log

[dundee]

i can't find any log entries about ODS.

Can you please give some more details?

[rajinp]

it is move product log itself.

[dundee]

I can't find any log entries about ODS.

I am also missing Eventlog entries. In the manual it says

These alerts can be displayed in any of three locations: the local system's Windows Event Log, the ePolicy

Orchestrator threat event log, or on the local system as a McAfee system tray pop-up menu

34269 On-demand scan started

34270 On-demand scan complete.

I can't see them anywherere