The EICAR Test File: Safely Testing Whether Your Scanner Works

The EICAR test file is a 68-byte string of printable characters that every antivirus vendor agrees to detect as if it were malware, so you can confirm a scanner is working without handling anything dangerous. Save the string as a file and your scanner should react instantly. A detection proves the signature layer and real-time protection are alive; it does not test heuristics or your defences against unknown threats.

What EICAR is

The European Institute for Computer Antivirus Research published the test file in the 1990s to solve a mundane problem: administrators wanted to check that antivirus was installed and running, and the only way to do that was to keep a real virus around. EICAR's answer was a string that vendors would agree to detect by convention. The string is:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

It is exactly 68 bytes, uses only printable ASCII, and, as a neat piece of engineering, is also a valid 16-bit DOS program: run under DOS as a .com file, it prints "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" and exits. That is the whole of its behaviour. It does not replicate, does not touch other files and does nothing at all on a modern operating system, where 16-bit DOS programs no longer run. It is detected because every engine ships a signature for it, and for no other reason.

The rules for a valid test file

EICAR's specification is stricter than most people realise, and getting it wrong is the usual reason a test "fails":

• The 68-character string must be the first 68 bytes of the file. Nothing before it, including a byte-order mark added by a text editor.
• The file may end with whitespace after the string, but the total length must not exceed 128 bytes. A single trailing newline is fine.
• The third character is a capital letter O, not a zero. The string is case-sensitive.
• Vendors are only obliged to detect the string as a stand-alone file. Detection inside other content (an email body, a web page, an Office document) is common but not guaranteed.

The safe way to create it is to write it from the shell rather than from a word processor, which may add a BOM, smart quotes or a hidden extension:

# macOS / Linux
printf 'X5O!P%%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.com

# Windows PowerShell (single quotes prevent variable expansion of $EICAR and $H)
Set-Content -Path eicar.com -Value 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' -NoNewline

Note the doubled %% and \\ in the printf version: printf treats % and \ specially, so they must be escaped to produce the literal characters. On a machine with working real-time protection the file will be quarantined the moment it is written, and you may see the shell report a permission error. That is the test passing.

What a detection should look like

Every engine names it differently. The label is unimportant, but it helps to recognise it:

A ClamAV scan of the file looks like this:

$ clamscan eicar.com
eicar.com: Win.Test.EICAR_HDB-1 FOUND

----------- SCAN SUMMARY -----------
Known viruses: 8712345
Engine version: 1.4.2
Scanned files: 1
Infected files: 1

The "Infected files: 1" line is the confirmation. Scan.now's file scanner reports the string at informational severity rather than as malware, because the whole point of the file is that it is not malicious; the finding tells you the signature engine saw and matched it, and the file is analysed in memory and discarded like any other upload.

Testing more than the basic case

EICAR distributes four variants, and the extra three are the useful ones once the plain file works:

1. eicar.com: the raw string. Tests that the scanner exists and matches signatures.
2. eicar.com.txt: the same bytes with a text extension. Tests that the scanner looks at content rather than trusting the extension, the principle behind the extension mismatch check.
3. eicar_com.zip: the file inside a zip archive. Tests that the scanner opens archives at all.
4. eicarcom2.zip: a zip inside a zip. Tests recursion depth, the setting that gateway and upload scanners most often have turned down for performance.

The nested variants matter because archive handling is where quiet failures live. A mail gateway that scans attachments but not the contents of zips passes the first test and fails the third, and its administrators may never know. The same logic applies to any pipeline you rely on: a web upload form, a shared drive with server-side scanning, a backup system. Put an eicarcom2.zip through it and see whether anything objects. The archives guide explains why depth limits exist and how to set them sensibly rather than switching them off.

What a pass proves, and what it does not

A detection tells you three concrete things: the scanner is installed and running, its signature database loaded, and (if the file was caught on write) real-time protection intercepts new files. Those are exactly the failures that happen in practice: a licence lapsed, a service crashed, an exclusion was added to a whole drive, a database update broke. EICAR finds all of them in seconds.

It tells you nothing about the parts of a scanner that decide whether it is any good. It does not exercise heuristics, emulation, machine-learning classifiers, reputation lookups or behavioural blocking, because EICAR matches on a plain signature and every engine short-circuits on it. A scanner that detects EICAR may still miss last night's malware build. Treat the test as a smoke test, in the engineering sense: it proves the machine is switched on, not that it works well. For a sense of the layers that EICAR does not touch, see how antivirus scanning works and signature versus heuristic detection.

Common reasons the test fails

• The file was created in an editor. Notepad may save with a BOM or as UTF-16; Word saves a document, not the string. Use the shell commands above or download the file from EICAR's own site.
• The browser or mail client blocked it first. Chrome, Firefox and most webmail refuse to download or attach EICAR. That is a pass for the browser's protection layer, not a fail for the scanner; create the file locally instead.
• The folder is excluded. Developers frequently exclude project directories from real-time scanning. Test in a directory you have not excluded.
• Only on-demand scanning is enabled. If nothing happens on write but a manual scan finds it, real-time protection is off.
• The string was altered. A zero for the letter O, a missing final asterisk or an added space at the start all invalidate it. Check the file's length is 68 bytes (or 69 with a newline).

The hash is public, so you can also confirm you have the exact bytes. The SHA-256 of the 68-byte string with no trailing newline is 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f. If your file hashes to something else, it is not the standard file. The file hashes guide shows how to compute it on every platform.

Where EICAR fits in a testing routine

The file earns its keep as a scheduled check rather than a one-off. A sensible routine for a small organisation: write eicar.com to each managed machine once a month and confirm an alert reaches whoever watches alerts; send eicarcom2.zip through the mail gateway to yourself each time the gateway is upgraded; drop the plain file into any shared storage that claims to scan on upload, and again after a vendor migration. Each of these takes a minute and has caught real outages: a scanning agent that silently stopped after an operating-system upgrade, a gateway licence that expired, a bucket where scanning was never enabled in the new region. None of that requires a security team, and none of it involves real malware, which is exactly the trade EICAR was created to make.

Using EICAR responsibly

Because it is harmless, EICAR is safe to put anywhere you would be nervous to put a real sample: a shared drive, an email to yourself, a form upload on a site you administer, an object-storage bucket with scanning enabled. It is also the polite way to test a service you do not own. Uploading real malware to someone else's system without permission is at best rude and possibly illegal; uploading EICAR is what the file was invented for. Keep the test file out of production directories once you are done, mainly because it will keep generating alerts, and remember that a scanner that has quarantined it has done exactly what you asked.