SAVTEST and SAVTST32 test utilities ----------------------------------Version 1.01, February 1999 www.sophos.com 1. Introduction --------------SAVTEST.

EXE is a utility designed to test the operation of Sophos Anti-Virus. It uses the EICAR test string, which SAV recognises as a virus. Note that the EICAR test string is NOT a virus in any way; it is a completely harmless short program designed to trigger the anti-virus software into recognising it as a virus. If Sophos Anti-Virus is functioning correctly, the presence of 'EICAR-AV-Test' will be reported. There is also a 32-bit version for Windows 95/98/Me and Windows NT Intel/Windows 2000, SAVTST32.EXE, which has a graphical interface. If no virus is reported after running SAVTEST or SAVTST32, please contact Support. 2. Testing on-access detection (InterCheck) ------------------------------------------To test InterCheck, select Test and then On-access test. This program will then attempt to create EICAR.COM file in the root directory of your hard drive, which should be intercepted and reported by InterCheck. Even if InterCheck is not functioning properly, EICAR.COM will be deleted from the hard disk before this program terminates. 3. Testing on-demand detection (SWEEP) -------------------------------------To test SWEEP, select Test and then On-demand test. This program will create EICAR.COM file in the root directory of your hard drive and when you next run SWEEP, it should discover it there. Once you have finished testing SWEEP, you can either run this utility again to clean up (select Cleanup), or you should manually delete EICAR.COM from the root directory of the hard drive. 4. SAVTST32.EXE and Windows XP -----------------------------Windows XP won't allow you to write directly to the root of C: when running SAVTST32.EXE. You will have to choose another place (for example the current user's Desktop), then run it. This is true both when running as Local Admin and when running as User.

An on-access test running as User won't succeed unless you have access to the directory involved. Place Eicar in a user-accessible folder. 5. SAVTST32.EXE does not display correctly -----------------------------------------Occasionally a probem may develop with SAVTST32.EXE where only the top bar of the application is displayed or the application is not displayed at all. This happens when the SAVTST32.INI file has become damaged. To rectify this, delete the file SAVTST32.INI from the Windows or WINNT folder on the affected computer. A new SAVTST32.INI file will be created the next time SAVTST32.EXE is run. ----------------

041223