The EICAR Anti-Virus Test File or EICAR test file is a computer file that was developed by the
European Institute for Computer Antivirus Research (EICAR) and
Computer Antivirus Research Organization to test the response of computer
antivirus
Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Antivirus software was originally developed to detect and remove computer viruses, hence the name ...
programs. Instead of using real malware, which could cause real damage, this test file allows people to test anti-virus software without having to use a real
computer virus
A computer virus is a type of malware that, when executed, replicates itself by modifying other computer programs and Code injection, inserting its own Computer language, code into those programs. If this replication succeeds, the affected areas ...
.
Anti-virus programmers set the EICAR string as a verified virus, similar to other identified signatures. A compliant virus scanner, when detecting the file, will respond in more or less the same manner as if it found a harmful virus. Not all virus scanners are compliant, and may not detect the file even when they are correctly configured. Neither the way in which the file is detected nor the wording with which it is flagged are standardized, and may differ from the way in which real malware is flagged, but should prevent it from executing as long as it meets the strict specification set by EICAR.
The use of the EICAR test string can be more versatile than straightforward detection: a file containing the EICAR test string can be
compressed or
archive
An archive is an accumulation of historical records or materials, in any medium, or the physical facility in which they are located.
Archives contain primary source documents that have accumulated over the course of an individual or organ ...
d, and then the antivirus software can be run to see whether it can detect the test string in the compressed file. Many of the
AMTSO Feature Settings Checks
are based on the EICAR test string.
Design
The file is a
text file
A text file (sometimes spelled textfile; an old alternative name is flat file) is a kind of computer file that is structured as a sequence of lines of electronic text. A text file exists stored as data within a computer file system.
In ope ...
of between 68 and 128
byte
The byte is a unit of digital information that most commonly consists of eight bits. Historically, the byte was the number of bits used to encode a single character of text in a computer and for this reason it is the smallest addressable un ...
s that is a legitimate
.com executable
In computer science, executable code, an executable file, or an executable program, sometimes simply referred to as an executable or binary, causes a computer "to perform indicated tasks according to encoded instruction (computer science), in ...
file (plain
x86
x86 (also known as 80x86 or the 8086 family) is a family of complex instruction set computer (CISC) instruction set architectures initially developed by Intel, based on the 8086 microprocessor and its 8-bit-external-bus variant, the 8088. Th ...
machine code
In computer programming, machine code is computer code consisting of machine language instructions, which are used to control a computer's central processing unit (CPU). For conventional binary computers, machine code is the binaryOn nonb ...
) that can be run by
MS-DOS
MS-DOS ( ; acronym for Microsoft Disk Operating System, also known as Microsoft DOS) is an operating system for x86-based personal computers mostly developed by Microsoft. Collectively, MS-DOS, its rebranding as IBM PC DOS, and a few op ...
, some work-alikes, and its successors
OS/2
OS/2 is a Proprietary software, proprietary computer operating system for x86 and PowerPC based personal computers. It was created and initially developed jointly by IBM and Microsoft, under the leadership of IBM software designer Ed Iacobucci, ...
and
Windows
Windows is a Product lining, product line of Proprietary software, proprietary graphical user interface, graphical operating systems developed and marketed by Microsoft. It is grouped into families and subfamilies that cater to particular sec ...
(except for 64-bit due to 16-bit limitations). The EICAR test file will print "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" when executed and then will stop. The test string was written by anti-virus researchers
Padgett Peterson and Paul Ducklin and
engineered to consist of
ASCII
ASCII ( ), an acronym for American Standard Code for Information Interchange, is a character encoding standard for representing a particular set of 95 (English language focused) printable character, printable and 33 control character, control c ...
human-readable characters, easily created using a standard computer keyboard. It makes use of
self-modifying code
In computer science, self-modifying code (SMC or SMoC) is source code, code that alters its own instruction (computer science), instructions while it is execution (computing), executing – usually to reduce the instruction path length and imp ...
to work around technical issues that this constraint imposes on the execution of the test string.
The EICAR test string reads
The third character is the capital 'O' in the
Latin alphabet
The Latin alphabet, also known as the Roman alphabet, is the collection of letters originally used by the Ancient Rome, ancient Romans to write the Latin language. Largely unaltered except several letters splitting—i.e. from , and from � ...
, not the digit zero.
Adoption
According to EICAR's specification the antivirus detects the test file only if it starts with the 68-byte test string and is not more than 128 bytes long. As a result, antiviruses are not expected to raise an alarm on some other document containing the test string. The test file can still be used for some malicious purposes, exploiting the reaction from the antivirus software. For example, a race condition involving
symlinks can cause antiviruses to delete themselves.
See also
*
GTUBE – a similar test for unsolicited bulk email (
email spam
Email spam, also referred to as junk email, spam mail, or simply spam, refers to unsolicited messages sent in bulk via email. The term originates from a Spam (Monty Python), Monty Python sketch, where the name of a canned meat product, "Spam (food ...
)
References
External links
* (also known as the European Expert Group for IT-Security)
An Examination of the EICAR's Standard A-V Test ProgramAssembly-language analysis of the EICAR test file
VirusTotalAntivirus results from scanning the EICAR file
*
{{Standard test item
Computer security software
Test items
pl:Europejski Instytut Badań Wirusów Komputerowych#Plik testowy EICAR