Malware scan does not detect EICAR test file on upload
This article explains how to enable and verify malware scanning in Adobe Experience Manager Assets when uploaded files are not being scanned or quarantined as expected.
Description description
Environment
- Adobe Experience Manager (AEM)
- Adobe Experience Manager (AEM) - Assets
Issue/Symptoms
When uploading the official EICAR test file to AEM Assets, the system does not detect or quarantine the file, indicating that malware scanning or antivirus protection is not active for uploaded assets. The uploaded file (e.g., eicar.txt, size below 2GB) is accepted without validation or warning, and no alerts are triggered in the application.
- No malware scan or quarantine action occurs for known test files.
- No error messages are displayed to the user.
- The issue is reproducible in all tested environments.
Cause
Malware scanning was not enabled in the AEM Assets configuration, resulting in the absence of antivirus validation for uploaded files.
Resolution resolution
To enable and verify malware scanning when an EICAR test file is not detected during upload in AEM Assets, follow these steps
- Log in to the AEM instance with an account that has administrative privileges.
- Navigate to Tools
>Assets>Assets Configurations. - Select Malware Scan Configuration from the available options.
- On the Malware Scan Configuration screen, enable malware scanning by turning on the Enable Malware Scan toggle.
- Click Save to apply the configuration changes.
- Upload the EICAR test file again to verify that the asset is now detected and quarantined as expected.
- (Optional) Review the documentation for further details: Malware Detection Configuration - Adobe Experience League
Warnings
- Malware scanning only applies to assets uploaded after the configuration is enabled. Existing assets in the DAM are not scanned retroactively.
- Assets larger than 2GB may not be scanned, as per product documentation.