EICAR Test File

Make Sure Your Antivirus Is Working

Was this page helpful?

The EICAR test file was created by the European Institute for Computer Antivirus Research—hence its name—in conjunction with the Computer Antivirus Research Organization. The file was designed to test how well antivirus software responded to a threat without using real malware.

Traditional antivirus software detects viruses and other malware using signature definitions. The EICAR test file is a non-viral string of code that most antivirus software manufacturers include in their products' signature definition files as a falsely verified virus.

When your antivirus software encounters the EICAR file, it should treat it exactly as it would a real virus.

The EICAR test file allows users to check whether their antivirus software is running properly. For example, if you try to open an Eicar.com test file while your real-time protection feature is enabled, the antivirus software should generate an alert. 

Creating an EICAR Test File

An EICAR test file can be easily created using any text editor, such as Notepad or TextEdit. To create an EICAR test file, copy and paste the following line into a blank text editor file:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Save the file as Eicar.com. It is now ready for testing. You can compress or archive your new file to test the ability of the antivirus to detect malware in a compressed or archived file. In fact, if your active protection was working properly, the simple act of saving the file should have triggered an alert: "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!"

Compatibility of an EICAR Test File

The test file is an executable file that can be read by MS-DOS, OS/2, and 32-bit Windows. It isn't compatible with 64-bit Windows.