How To: Test your anti-virus software

WARNING: This web page contains links to files that contain a harmless test file which virus detectors are programmed to treat as a virus. If you receive alerts from your anti-virus software, do not be alarmed. Read on, to discover what is happening.

Creating a test virus

Have you ever wondered if your anti-virus software is really working? Would you like to see what happens when it detects a virus? Here's a safe way to test your computer's virus protection that doesn't require you to have a real virus sample.

First, open Notepad. Then copy and paste into it the text on the line below. (It should all be on one line.)

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Then select File, Save, select All Files for the file type, then save the file as eicar.com. The result should look exactly like the screenshot below:

Creating the EICAR test virus

Your anti-virus software may prevent you from saving the file as eicar.com, which is a sign that it is working effectively. If it doesn't raise an alert, try scanning the folder where you saved eicar.com. To see what happens if you try to run a file containing a virus, double-click eicar.com to open it.

Explanation

The file eicar.com you have created is completely safe. It is not a virus. It is a standard test file developed by the European Institute for Computer Anti-virus Research (EICAR). All anti-virus products are programmed to detect this file as if it was a real virus. Therefore you can safely use it to test whether your anti-virus software works, without fear of infecting your computer.

If your anti-virus product should fail to prevent you from running the file, it will simply display the text "EICAR-STANDARD-ANTIVIRUS-TEST-FILE" in a DOS box. No harm will have been done, but you should probably consider using a better anti-virus product, because if it had been a real virus, your computer would by now be infected!

Other ways to perform the Eicar.com test

If you don't want to try creating the virus test file by hand, here are some easier ways to get it. They will also provide a useful test of how effective your anti-virus software is at preventing you from downloading a virus.

Your anti-virus software should alert you when you try renaming the text file or unzipping the archive, and it should prevent you from completing the direct download. At the very least, it should prevent you from running the file eicar.com after it has been created or downloaded.

Alerts while viewing this page

If you're using some Web accelerator software or a product that includes a web accelerator feature such as AdShield, you may receive virus alerts while viewing this web page. Do not be alarmed! This is occurring because the accelerator has followed the link and downloaded the files shown above and your virus detector has found the Eicar test file in them!.

Kaspersky Anti-virus - for more information, click here