Storage function check

After removing an infected object, Kaspersky Endpoint Security places this object to the Storage.

You can use the EICAR test file to check the Storage function. This test virus was developed by The European Institute for Computer Antivirus Research (EICAR) to check the operation of anti-virus programs.

The EICAR test file is not a virus and does not contain program code that can harm your computer, but most anti-virus programs identify it as a threat.

The file that contains the test virus is called eicar.com. You can download it from the EICAR website.

To check the Storage function:

  1. Download the test file from Internet:

    curl https://www.eicar.org/download/eicar.com.txt -o /root/eicar.com.txt

  2. Create EICAR test file:

    echo -n 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > standard

    The test file is deleted after several seconds or immediately if you try to open it.

  3. Check Storage by executing the following command:

    kesl-control -B –query

    Both test files are placed to the Storage.

  4. Use the query to view test files in the Storage by field names. For example:
    • Query all files that contain standard in the FileName field:

      kesl-control -B --query "FileName like '%standard%'"

    • Query all files that were moved to the Storage after the time interval specified in the UNIX time stamp system (the number of seconds that have elapsed since 00:00:00 (UTC), 1 January 1970):

      kesl-control -B --query "AddTime > '1588252951'"

    For more information about using the query, please refer to the Using logical expressions section.

  5. Try to restore a file by using the ObjectId field:

    kesl-control -B --restore 1

    The file is restored to its original location. The ls command does not open the file, so it is not deleted by the File Threat Protection task. But when you cat it, the file will be detected and removed, and moved to the Storage.

  6. Try to restore the second test file to different location:

    kesl-control -B --restore 2 --file /tmp/newfile

    The file is restored to the specified location.

  7. If necessary, remove objects from the Storage by using the query system.
Page top