EICAR Antivirus Test File

EICAR Test File

NOTE: if the file opens as text in a browser tab, instead of simply downloading (for example, in Chrome), then right-click anywhere in the browser window and select “Save as…” from the context menu. It should show you the option to save as EicarTestFile.vbs. If this suggestion doesn’t work, try a different web browser. I was able to download it as a file using Edge and Internet Explorer, but in Google Chrome it opened as text in a browser tab.

EXPLANATION AND USE

The EICAR test file is an industry-standard file for testing antivirus software. It was developed by the European Institute for Computer Anti-Virus Research (EICAR).

You can read more about it, and learn to create your own test file, at eicar.org.

The test file is harmless, but all major antivirus vendors support the file. If you scan the file with your antivirus software, it will be treated as a threat in the “severe” category.

Test results will vary, depending on (1) what antivirus software you’re using, and (2) how it’s configured. For example, if your antivirus software is configured to scan USB drives as soon as they’re plugged into the computer, then it will be detected immediately. However, if your AV software doesn’t scan files on USB drives until they’re (1) used or (2) copied to the hard disk, you may not see any results right away.

Actions taken after detection will also vary. If your AV software is configured to “quarantine without prompt,” then the file will be quarantined. If your AV software is configured to “delete immediately,” then the file will be deleted. There are other possibilities, but you get the idea. You can check your AV software’s logfile to see what happened.

Figure 1: Example of Antivirus History Logfile

For IT and cybersecurity workers, there’s a problem: how do you store the EICAR test file if it’s constantly being deleted?

That’s why I wrote EicarTestFile.vbs.

Figure 2: Screenshot of EicarTestFile.vbs in action

EicarTestFile.vbs is not the EICAR test file. Instead, it’s a Visual Basic Script file that creates the EICAR test file. The actual EICAR test file that will be created is named eicar (dot) com. You can keep this file creation tool on a server or on a flash drive, and copy it to any computer you want to test.

Feel free to download it and use it. There’s no fee, and no registration. Also, files with the .vbs file extension can be opened in Notepad or any other text editor. You can inspect the file yourself to verify that it only does what’s described here.

Download EicarTestFile.vbs