THE EICAR STANDARD ANTI-VIRUS TEST FILE

( From an article by Paul Ducklin at http://www.eicar.com.)

This test file has been provided to EICAR for distribution as the "EICAR Standard Anti-Virus Test File", and it satisifies all the criteria listed above. It is safe to pass around, because it is not a virus, and does not include any fragments of viral code. Most products react to it as if it were a virus (though they typically report it with an obvious name, such as "EICAR-AV-Test").
The file is a legitimate DOS program, and produces sensible results when run ( it prints the message "EICAR-STANDARD-ANTIVIRUS-TEST-FILE").
It is also short and simple -- in fact, it consists entirely of printable ASCII characters, so that it can easily be created with a regular text editor. Any anti-virus product which supports the EICAR test file should "detect" it in any file which starts with the following 68 characters:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

To keep things simple, the file uses only upper case letters, digits and punctuation marks, and does not include spaces. The only thing to watch out for when typing in the test file is that the third character is the capital letter "O", not the digit zero. You are encouraged to make use of the EICAR test file. If you are aware of people who are looking for real viruses "for test purposes", bring the test file to their attention.

Click here if you wish to see a detailed analysis of the program's code: All the Details of EICAR.COM using DEBUG.


Back to the Starman's VIRUS page.