scan.now
Premium Scan a site

EICAR antivirus test file

The file contains the EICAR test string, a harmless sequence that every antivirus engine is required to detect. It is not malware.

Do this: Nothing to do; this is the harmless antivirus test file. EICAR is the industry's harmless test string; finding it proves the scanner works.
PassThis is not the EICAR test file.
InfoThis is the harmless EICAR antivirus test file.

The fix, in one snippet

Example to adapt What it is 
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

The scanner looks for the 68-byte EICAR string at the start of the file, allowing the trailing whitespace the standard permits (up to 128 bytes in total), and compares the SHA-256 of the canonical file. It also looks inside zip archives for the standard eicar_com.zip and eicarcom2.zip forms. ClamAV, when configured, reports it as Win.Test.EICAR_HDB-1. The string is:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

It is a valid DOS COM program that prints its own name and exits; it does nothing else, on any platform.

Why it matters

EICAR exists so that people can confirm a scanner is running without handling real malware. Mail gateways, endpoint agents and upload filters are tested with it, and vendors agree to detect it. Seeing this finding proves that Scan.now's detection path works end to end. It proves nothing about how well any scanner handles modern threats, which is a common misunderstanding: EICAR is a fixed string with a dedicated signature, not a test of heuristics or behaviour analysis. If a file arrived unexpectedly with EICAR in it, someone is probably testing a filter; it cannot harm you.

How to fix it

Nothing to fix. Delete the file if you do not need it; your local antivirus will most likely quarantine it on download, which is the expected behaviour. To test your own protection, create the file yourself by typing the string into a plain text editor and saving it as eicar.com; many scanners block the download of a ready-made copy. Then watch for the detection notice and check the quarantine log. To test archive scanning, zip it and scan the zip. The details, including what a detection does and does not prove, are in the EICAR guide, how antivirus scanning works and ClamAV explained.

Where this fits

EICAR antivirus test file is check 19 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Password-protected archive (medium), where the archive's contents are encrypted with a password, so neither Scan.now nor your antivirus can inspect what is inside before you extract it. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

EICAR antivirus test file closes one route in. The next one down is File hash reputation, where scan.now computed the file's SHA-256 (plus MD5 and SHA-1 for comparison with older feeds) and compared it with the hash lists it holds; this entry explains what a match or a miss means.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: EICAR antivirus test file (info severity)
Scanner check id: eicar-test-signature
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. EICAR: Anti-Malware Testfile
  2. Microsoft: Validate antimalware detections with the EICAR test file
  3. ClamAV documentation

Related guides

7 min read · Updated Sep 10, 2026 The EICAR Test File: Safely Testing Whether Your Scanner Works

EICAR is a harmless 68-byte string every antivirus is required to detect. What it is, how to create it, what a detection should look...

Read the guide 8 min read · Updated Sep 02, 2026 How Antivirus and Malware Scanning Actually Works

A scanner decides whether a file is malicious by matching known signatures, analysing structure, emulating behaviour and consulting...

Read the guide 8 min read · Updated Sep 15, 2026 ClamAV Explained: The Open-Source Antivirus Engine and What Its Verdicts Mean

ClamAV is the open-source engine behind mail gateways, file servers and many online scanners. Its signature databases, what it detects...

Read the guide