EICAR Test File
Download EicarTestFile.vbs
NOTE: if the file opens as text in a browser tab,
instead of simply downloading (for example, in Chrome), then right-click
anywhere in the browser window and select “Save as...” from the context menu.
It should show you the option to save as EicarTestFile.vbs. If this suggestion
doesn’t work, try a different web browser. I was able to download it as a file
using Edge and Internet Explorer, but in Google Chrome it opened as text in a
browser tab.
EXPLANATION AND USE
The EICAR test file is an industry-standard file for
testing antivirus software. It was developed by the European Institute for
Computer Anti-Virus Research (EICAR).
You can read more about it, and learn to create your own
test file, at eicar.org.
The test file is harmless, but all major antivirus vendors
support the file. If you scan the file with your antivirus software, it will be
treated as a threat in the “severe” category.
Test results will vary, depending on (1) what antivirus
software you’re using, and (2) how it’s configured. For example, if your
antivirus software is configured to scan USB drives as soon as they’re plugged
into the computer, then it will be detected immediately. However, if your AV
software doesn’t scan files on USB drives until they’re (1) used or (2) copied
to the hard disk, you may not see any results right away.
Actions taken after detection will also vary. If your AV
software is configured to “quarantine without prompt,” then the file will be
quarantined. If your AV software is configured to “delete immediately,” then
the file will be deleted. There are other possibilities, but you get the idea.
You can check your AV software’s logfile to see what happened.
Figure
1: Example of Antivirus History Logfile
For IT and cybersecurity workers, there’s a
problem: how do you store the EICAR test file if it’s constantly being deleted?
That’s why I wrote EicarTestFile.vbs.
Figure
2: Screenshot of EicarTestFile.vbs in action
EicarTestFile.vbs is not the EICAR test file.
Instead, it’s a Visual Basic Script file that creates
the EICAR test file. The actual EICAR test file that will be created is named eicar (dot) com. You can keep this file creation tool on a
server or on a flash drive, and copy it to any computer you want to test.
Feel free to download it and use it. There’s no fee, and no
registration. Also, files with the .vbs file
extension can be opened in Notepad or any other text editor. You can inspect
the file yourself to verify that it only does what’s described here.
Download EicarTestFile.vbs
NOTE: if the file opens as text in a browser
tab, instead of simply downloading (for example, in Chrome), then right-click
anywhere in the browser window and select “Save as...” from the context menu.
It should show you the option to save as EicarTestFile.vbs. If this suggestion
doesn’t work, try a different web browser. I was able to download it as a file
using Edge and Internet Explorer, but in Google Chrome it opened as text in a
browser tab. This will vary based on browser versions and settings.