2
\$\begingroup\$

Write the smallest program which triggers the virus alarm of at least two major (and different) anti-virus programs. Different versions of the same scanner, or two companies selling basically the same engine or variants thereof don't count as different.

Using the EICAR test file or similar file explicitly created as a test pattern, either directly or indirectly, will double your code size.

Your program is not required to (try to) do actual damage to the system. Just triggering the scanner to detect it as a virus/malware is enough. However, if the scanner just asks about all unknown programs "are you sure you want to run this?", it is not enough.

Standard code golf rules apply, no downloading pre-defined files, etc. All behavior must be included in your program.

Your program must work without crashing in the event no anti-malware program is running on the system.

\$\endgroup\$
  • \$\begingroup\$ If you're having an archery contest, make sure everyone is aiming at the same target. How about choosing a specific cross-platform AV package and a specific revision of virus definitions for that package? E.g. ClamAV and whatever definitions are currently the head for it. \$\endgroup\$ – Jonathan Van Matre Mar 12 '14 at 20:54
  • \$\begingroup\$ @JonathanVanMatre : looking at the history of questions, it seems platform independence is favored here. Very few questions make constraints based on OS, architecture, processor speed, etc. However, if enough people complain, I might change it. \$\endgroup\$ – vsz Mar 12 '14 at 21:00
  • 1
    \$\begingroup\$ I'm not advocating against platform independence, which is why I specifically stated "cross-platform". What I am advocating is having a specific target so that the comparison of one program to another will have meaning beyond "Who chose a more twitchy scanning program to trigger?" \$\endgroup\$ – Jonathan Van Matre Mar 12 '14 at 21:03
  • 1
    \$\begingroup\$ Programs on the Stack Exchange must not cause harm to the computer. \$\endgroup\$ – Hosch250 Mar 12 '14 at 21:36
  • 2
    \$\begingroup\$ The OP did not request code that does harm to the computer. \$\endgroup\$ – MrPaulch Mar 14 '14 at 21:59
9
\$\begingroup\$

x86 Assembly: 4 bytes

The almighty Pentium F00F bug! Lock up an old Pentium in one instruction:

lock cmpxchg8b eax

As raw hexadecimal data:

F0 0F C7 C8

Flagged as malicious by Comodo, McAfee, and Panda according to VirusTotal. Long since fixed in Intel microprocessors, of course.

\$\endgroup\$
9
\$\begingroup\$

Windows batch (33)

@echo off
del c:\windows\system32

Save it as a batch file. According to this, it triggers at least 13 antivirus.

\$\endgroup\$
  • \$\begingroup\$ Thank you for your link. I hope you aren't mad that I used the online website you provided. \$\endgroup\$ – Ismael Miguel Mar 12 '14 at 21:06
  • \$\begingroup\$ Does it also work if you remove the @echo off? How about if you remove system32? \$\endgroup\$ – FUZxxl Mar 29 '15 at 23:34
0
\$\begingroup\$

VBscript (0 bytes), Windows NT or higher only:

Create a file with the extension '.vbs' and paste this code:



Try to open it (double-click on it).

Most likely your anti-virus will block it (most anti-virus will block VBscripts)

\$\endgroup\$
  • \$\begingroup\$ Sorry, but the scanner has to detect it as malware. I explicitly specified that just blocking an unknown program with an "are you sure" or "might be unsafe" or similar criteria is not enough. It has to be explicitly detected as malware. Not necessarily a specific one, it's enough if the behavior triggers an alarm based on heuristics. \$\endgroup\$ – vsz Mar 12 '14 at 21:02
  • \$\begingroup\$ "However, if the scanner just asks about all unknown programs "are you sure you want to run this?", it is not enough." --> This is totally different from your comment. And check here: virustotal.com/en/file/… (the name is different, it won't let analise again my empty file) \$\endgroup\$ – Ismael Miguel Mar 12 '14 at 21:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.