EICAR STANDARD ANTI-VIRUS TEST

10/26/96

The European Institute for Computer Antivirus Research (EICAR) has developed a short, standard Anti-VIRUS test that can be used to test Anti-Virus Software installation. This is done by creating a test file which should then trigger a message from a properly installed Virus Detector indicating that the EICAR-STANDARD-ANTI-VIRUS-TEST- FILE has been found. The file -- which should be 69 or 70 bytes long can be created by executing the following DOS command

ECHO X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H* >EICAR.COM

(That's all one line).

The file EICAR.COM is not a Virus, but it should be reported as one by a properly installed Virus Detector. It should be removed after testing is completed.

NOTE: When I tried this with an elderly version of McAfee, it did not detect the file, but did report some non-critical errors that were probably unrelated and which it scrolled off the screen before I could read them.

NOTE: It appears that anti-virus programs did not adopt this convention. I have rarely seen EICAR files such as this one detected by anti-virus programs.