EICAR Test File

The purpose of the EICAR test file is to provide an industry standard solution to the following questions:

1. Is my anti-virus program installed correctly - that is, does it intercept and/or detect viruses as it is supposed to ?
2. What happens when the anti-virus program finds a virus ?
3. Which messages are displayed ?
4. What about "custom warnings", batch files, system admin notifications over the network ?

The idea is that anti-virus programs detect the file exactly like they detect viruses, and treat it as one - for example as a 78-byte overwriting virus (when disinfecting).

The same purpose would of course be served by a custom test file for each program, but this may simplify the testing process, in particular when multiple products are being tested and evaluated.

The EICAR test file looks like this:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

and should be saved to a file with a .COM extension (EICAR.COM being the most obvious choice).

When run, it will display the string "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!".

As a side note, the file is made printable so that it can easily be printed in a manual, included in the documentation, dictated over the phone or sent by fax. It is not recommended that the file be included "stand alone" in the anti-virus package in "binary form", as users might run the anti-virus program on the package before realizing what the file is for.

The EICAR test file is the result of a cooperative effort between various anti-virus researchers. It is not vendor specific and is being made available free of charge.

Please e-mail Technical Support with questions or comments about the EICAR test file.