Test your antivirus with the EICAR test file

Is your antivirus software functioning correctly like it should? Will it detect if a virus is dropped on your hard disk? You can test your antivirus using the EICAR (European Institute for Computer AntiVirus Research) antivirus test file. The Eicar test file is recognized by all the antivirus products and they all should block it.

You can either download the eicar test file from http://www.eicar.org/anti_virus_test_file.htm or you can create your own. To create your own eicar test file, simply open Windows Notepad and copy paste the following string into it.

X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Save the file with a .COM extension anywhere on your hard disk, for example, I saved it as d:eicar.com. Then, open a command prompt window and try to run it by giving the command d:eicar.com (depending on the path you saved the file to).

Save EICAR test file in Notepad

When you run the eicar test file (which is a small program coded to display EICAR-STANDARD-ANTIVIRUS-TEST-FILE!) in a command prompt window, your antivirus software should block it and delete it. If your antivirus software is disabled, turned off or simply damaged and is not able to detect the Eicar test file, then the Eicar test file will execute and show a text string in the command prompt window.

Running EICAR test file in command prompt window

If you run the eicar test file and see the above text string, then it should ring a bell that your antivirus is non-functional. However, if your antivirus program detects it even before you try to run it, then it is a good news – your antivirus program is actively protecting you. The following is a snapshot of avast! antivirus 5.0 blocking the eicar test file.

avast! antivirus 5.0 blocks EICAR test file

This is how AVG antivirus 2011 detects the eicar test file —

AVG antivirus 2011 blocks EICAR test file

Security researcher Didier Stevens has also created a tiny program called EicarGen which creates the eicar test file on your hard disk automatically. You can download the EicarGen program from his blog at http://blog.didierstevens.com/programs/eicargen/.